feat(web): W3-1 shared console routes, nav, api/sse/query-keys and shared components

- routes.ts registers all workspaces under /console (+ detail routes, engine, audit, login)
- api.ts: cookie session first (credentials include, CSRF header), Bearer only with stored key, 401 -> /login
- sse.ts: shared EventSource with ?after=seq catch-up, backoff reconnect, per-type subscribe
- shared components: data-table, filter-bar, detail-sheet, timeline, json-view, confirm-dialog,
  form-field, kv-list, stat-tile, error/loading states; ui tabs and textarea

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/lib/query-keys.ts

@@ -0,0 +1,45 @@
+// 查询 key 统一在这里生成,SSE 失效与跨页刷新靠它对齐。
+// 约定:[area, "list", params?] / [area, "detail", id] / [area, 其它子资源...];
+// invalidate 某区域全部数据用 qk.all(area)。
+
+export type QueryArea =
+  | "auth"
+  | "health"
+  | "dashboard"
+  | "settings"
+  | "api-keys"
+  | "secrets"
+  | "library-roots"
+  | "downloader-instances"
+  | "media-server-instances"
+  | "path-mappings"
+  | "sites"
+  | "site-accounts"
+  | "audit"
+  | "engine"
+  | "media"
+  | "identity"
+  | "organize"
+  | "subscriptions"
+  | "preferences"
+  | "inbox"
+  | "decisions"
+  | "sources"
+  | "feeds"
+  | "tasks"
+  | "downloads"
+  | "agent"
+  | (string & {});
+
+export const qk = {
+  all: (area: QueryArea) => [area] as const,
+  list: (area: QueryArea, params?: object) => (params ? ([area, "list", params] as const) : ([area, "list"] as const)),
+  detail: (area: QueryArea, id: string) => [area, "detail", id] as const,
+  sub: (area: QueryArea, ...parts: (string | number | object)[]) => [area, ...parts] as const,
+
+  session: ["auth", "session"] as const,
+  health: ["health"] as const,
+  dashboard: ["dashboard"] as const,
+  settings: ["settings"] as const,
+  engineStats: ["engine", "stats"] as const,
+};