feat(web): W3-1 login, session shell, home dashboard, settings, engine panel and audit pages

- /login: setup/login/TOTP states driven by server error codes, fixed-height error slot
- console layout: GET /auth/session gate, redirect to /login, account popover (change password, logout)
- home: six dashboard sections with SSE-driven refresh, automation switch and read-only reconcile toggle
- settings tabs: downloaders, media servers, library roots, path mappings, site credentials,
  API keys (one-time plaintext), Pi upstream, cache/organize/retention/budget, automation
- engine: runs list (status/name filters, cursor paging, stats tiles), run detail (step timeline,
  json payloads, signals, cancel)
- audit: filterable list with detail sheet
- vite: allow repo root in server.fs so deno-installed deps under node_modules/.deno load in dev

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/vite.config.ts

@@ -57,6 +57,8 @@ export default defineConfig(({ mode }) => {
     server: {
       port: 5180,
       strictPort: true,
+      // 依赖装在仓库根 node_modules/.deno(deno workspace),vite 找不到 npm workspace 根,需显式放行
+      fs: { allow: [path.resolve(process.cwd(), "../..")] },
       proxy: {
         "/api": { target: apiTarget, changeOrigin: true },
       },