feat(web): W4-A wire console to real endpoints

- Agent page uses contracts (AgentRun/AgentRunDetail/AgentGoalReport) instead of a local
  mirror; ?mock=1 stays as an explicit demo switch; run snapshot refreshes on agent.run_status;
  stream auto-follow only while the user stays near the bottom (abort stays reachable)
- settings: Pi provider select incl. fake, new Agent runtime card (budgets, fakeScript)
- download trace uses /tasks?subjectId= and /organization-records?downloadTaskId= instead of
  time-window engine run matching and path matching; new business-task tab with cancel/retry
- workbench download dialog posts /acquisition-plans and shows per-slot rejection reasons
- preference tag revision history; subscription search by title/kind; identity/alias/subscription
  lists show entity titles; slot cards show current asset summary; policy preview sample titles
- DecisionSummary / IdentityRevisionList / ReleaseIdentityResult / TaskAccepted / PolicyPreviewSummary /
  OrganizePlanArtifactContent taken from contracts
- docs: SSE for console (cookie) vs GET /events?after=&limit= JSON replay for API keys

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/preferences.ts

@@ -6,6 +6,7 @@ import {
   PreferenceSuppression,
   PreferenceTag,
   type PreferenceTagCreate,
+  PreferenceTagRevisionList,
   type PreferenceTagUpdate,
 } from "@umt/contracts";
 import { api } from "~/lib/api.ts";
@@ -45,6 +46,16 @@ export function useSuppressions(active?: boolean) {
   });
 }
 
+/** 修订历史(审计事件回放,新→旧) */
+export function useTagRevisions(id: string | null | undefined) {
+  return useQuery({
+    queryKey: ["preferences", "revisions", id ?? ""],
+    enabled: !!id,
+    queryFn: async ({ signal }) =>
+      (await getParsed(PreferenceTagRevisionList, `/preference-tags/${id}/revisions`, undefined, signal)).items,
+  });
+}
+
 function useInvalidate() {
   const qc = useQueryClient();
   return () => void qc.invalidateQueries({ queryKey: preferenceKeys.all });