feat(web): Add the web console server, security and setup planner

[4ndreello]

First implementation wave of the web console spec (#108): tasks T1 to T9 and T14. No user-facing web setup or usage page yet; those land in the next PRs on top of this base.

What changes:

• src/web/server.ts is the shared local server, extracted from codedeck review. It binds 127.0.0.1 (default port 3100), dispatches a route table, reads the real port from server.address() after listen, and takes injectable close/exit so shutdown is testable.
• src/web/security.ts rejects any Host other than 127.0.0.1:<port> or localhost:<port> with 403, requires the per-start token cookie plus a matching Origin on every POST, and sets frame-ancestors 'none' on pages. The token (32 random bytes) travels only in the URL that openBrowser opens or the CLI prints; the GET carrying it sets codedeck_ui_token_<port> and redirects with 303 to strip it.
• codedeck review now runs on the shared server with the same routes (/, /review, GET /api/review), port and flags.
• codedeck ui serves a home page that links only to registered routes, so today it lists Review only.
• src/cli/index.ts builds the program in createCliProgram() and parses only when it is the entry point (resolved through realpathSync), so tests can load it. Checked by hand: node dist/cli/index.js, a symlinked bin, and the ~/.run-agent/bin/codedeck launcher all still run.
• src/config/setup.ts holds the pure setup planner (buildSetupPlan) plus diffConfig, the binding validation and resolveSetupTarget, moved out of the CLI so the config layer imports nothing from src/cli. The wizard and runSetupBatch both call it. Existing cases in setup-wizard.test.ts and setup-cli-contract.test.ts are unchanged.
• src/core/usage-query.ts holds buildUsageQueryParams, extracted from usage.ts without behavior change, so /api/usage can reuse it later.

Verification on this branch (scoped batches, never the full suite):

web + review:  npx vitest run tests/web-server.test.ts tests/web-pages.test.ts tests/web-security.test.ts tests/web-cli.test.ts tests/review.test.ts tests/review-command.test.ts
               Test Files 6 passed (6), Tests 36 passed (36)
setup (P3):    npx vitest run tests/setup-plan.test.ts tests/setup-wizard.test.ts tests/setup-cli-contract.test.ts
               Test Files 3 passed (3), Tests 119 passed (119)
usage:         npx vitest run tests/usage-cli.test.ts tests/usage.test.ts tests/usage-query.test.ts tests/usage-statusline-contract.test.ts
               Test Files 4 passed (4), Tests 37 passed (37)
open-args:     Tests 92 passed (92)
tsc --noEmit:  exit 0
npm run build: exit 0
pty-gate.sh:   exit 0

Mutation probes. Each fault was injected in place, the file was restored, and cmp confirmed it was identical afterwards:

fault	result
accept a mismatched Origin on POST	killed (web-security)
ignore server.address() for the URL	killed (web-server)
disable the Host check (both call sites)	killed (web-security, "rejects a missing or unapproved Host")
drop effort from planned bindings	killed (4 tests across planner, wizard, batch)
erase the orchestrator when the selection omits it	killed (planner, wizard)
write an autocompact block when turning it off with none	killed (setup-plan)
map --days 7 to 30d	killed (usage-cli)

Known leftover: the Host check runs twice, in dispatchRequest and in checkWebRequest. It is harmless but redundant; turning off only one of them does not change behavior. It will be cleaned up in a later slice.

Spec status: 27 requirements are marked Implemented in the traceability table, and tasks.md records T1 to T9 and T14 as done.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud