feat(web): Add the web setup and usage pages

[4ndreello]

Second and last implementation wave of the web console spec (#108), on top of #111: tasks T10 to T13 and T15 to T19. After this, codedeck setup and codedeck usage --web run in the browser.

What changes:

• src/web/setup-page.ts and src/web/setup-routes.ts add the browser setup: role bindings, efforts, orchestrator mode, sandbox and autocompact, prefilled from the current config. Routes: GET /api/setup/state, GET /api/setup/catalog, POST /api/setup/catalog/refresh, POST /api/setup/dry-run, POST /api/setup/apply. The config is read through the same batch path as setup --json (invalid config answers code 14, unreadable 15) and never replaced by defaults. Bodies are capped at 64 KiB. Off-catalog models only save with a per-role confirmation. Responses reuse the setup --json envelope (proposta, validacoes, mudancas, resultado).
• src/web/usage-page.ts and src/web/usage-routes.ts add the usage page and GET /api/usage. The query goes through buildUsageQueryParams, so the page and codedeck usage build identical parameters for the same filters.
• codedeck setup on an interactive terminal opens the web page. --tui keeps the terminal wizard. Without a TTY it still exits 1 with the existing message, and --json, --dry-run, --non-interactive never start a server. New flags: --port, --no-open.
• codedeck usage --web opens the usage page. usage <run-id> and --run keep usage.get, with or without --web.
• codedeck ui now lists Review, Setup and Usage on the home.
• src/web/server.ts drops the duplicate Host check noted in feat(web): Add the web console server, security and setup planner #111. The check now lives only in checkWebRequest.
• README documents the new commands.
• .specs/features/web-console: 66 traceability rows moved to Implemented, and the coverage matrix points the page tests at tests/setup-page.test.ts and tests/usage-page.test.ts.

Verification on this branch (scoped batches, never the full suite):

batch 1: 5 files, 67 tests passed
batch 2: 4 files, 122 tests passed
batch 3: 6 files, 56 tests passed
batch 4: usage, usage-query, open-args, statusline: 4 files, 126 tests passed
P4:      npx vitest run tests/setup-web.test.ts tests/setup-page.test.ts tests/web-cli.test.ts tests/setup-cli-contract.test.ts
         Test Files 4 passed (4), Tests 71 passed (71)
P5:      npx vitest run tests/usage-cli.test.ts tests/usage-web.test.ts tests/usage-page.test.ts tests/web-cli.test.ts tests/usage-statusline-contract.test.ts tests/web-pages.test.ts
         Test Files 6 passed (6), Tests 58 passed (58)
tsc --noEmit:  exit 0
npm run build: exit 0
validate_spec: 0 errors, 0 warnings. validate_tasks: 0 errors, 1 warning (T19 is docs only, matrix says none)

Smoke test of the built codedeck ui --no-open --port 3197 with curl: the token URL answers 303 with an HttpOnly, SameSite=Strict cookie. Every page and GET API answers 200 with the cookie. A foreign Host answers 403, and so does a POST without the cookie or with a foreign Origin. A no-change dry-run answers unchanged, saved:false, and the config file hash stays the same.

Mutation probes. Each fault was injected in place, then the file was restored and checked identical with cmp:

fault	result
drop the agent filter from the usage query	killed (2)
clear the last good usage result on error	killed (1)
treat a missing byOrigin as required	killed (2, including the node:vm test)
dry-run saves the config	killed
apply an off-catalog changed binding without confirmation	killed
bypass the invalid-config guard	killed (apply returns 14, saved=false)
setup without a TTY no longer exits 1	killed
usage <run-id> --web skips usage.get	killed
drop the setup routes from codedeck ui	killed (2 in web-cli)
refresh sends GET again	killed (setup-page)
browser fetch adapter drops init	killed (setup-page node:vm)

Review: two read-only review rounds (claude opus) over the whole scope. Round one found that the catalog refresh button sent GET to the POST-only route, so the button and setup --refresh were broken. That is fixed and now asserted in both the controller test and the node:vm test, and both revert probes are killed. Round two confirmed the fix, found no other method mismatch, and mapped every P4 and P5 criterion to code and a test. WEB-82 now cites the README sections instead of line numbers.

Known leftovers: setup --refresh injects a small script into the /setup response to trigger the catalog refresh after load. With the duplicate check gone, a bad Host combined with a malformed URL now answers 400 instead of 403. Both still refuse the request. With usage --web --days 14, the Since date input shows empty because it receives a full ISO timestamp, but the query still applies it.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.2% Duplication on New Code

See analysis details on SonarQube Cloud