web: home route with real session list, filters, keyboard cursor

- api/client.ts: apiFetch with AuthError/APIError, 401 and problem+json handling
- api/adapters.ts: SessionDTO→Session adapter with composite id and epoch conversion
- api/adapters.test.ts: 6 TDD tests covering all specified edge cases
- features/home/useSessions.ts: TanStack Query hook with since/tool/host params
- features/home/FilterChips.tsx: chip-bar with popovers, Esc/outside-click dismiss
- features/home/SessionsTable.tsx: grid table with cursor row highlight, formatStarted/formatTok
- features/home/useHomeCursor.ts: cursor hook with move/activate/jumpTo
- routes/index.tsx: Home route wired to real data, URL-driven filters, keyboard cursor
- routes/__root.tsx: cursorRef + KeyboardCursorContext for route-local cursor registration
- routes/session.$tool.$host.$id.tsx: stub for Phase 6
- styles/home.css: .home-table/.home-thead/.home-row/.home-row.cursor grid rules
- primitives/ToolDot.tsx: widened tool prop to string (Tool type is open-ended)

web: shell, theme, keyboard, stub routes, palette skeleton

- lib/theme.ts: bootstrapTheme() + setTheme() with OS/localStorage sync
- lib/keyboard.ts: g-prefix nav, j/k cursor, ⌘K palette, Esc, Enter
- lib/theme.test.ts + lib/keyboard.test.ts: 26 vitest tests (TDD)
- shell/TopBar.tsx: brand crumb, search trigger, tab nav using router pathname
- shell/SubBar.tsx: slot component with optional right section
- shell/Palette.tsx: modal overlay, JUMP items, synthetic SEARCH row
- styles/shell.css + styles/palette.css: ported verbatim from prototype.css
- routes/__root.tsx: wires TopBar, Outlet, Palette, keyboard controller, bootstrapTheme
- routes/index.tsx + projects/stats/health/settings/search.tsx: EmptyState stubs
- main.tsx: replace scaffold div with RouterProvider
- vitest.config.ts: add jsdom url for localStorage support (Node 25 compat)

server: embed web SPA at /, wire build pipeline

- Add internal/server/web/embed.go with //go:embed all:dist and a
  SPA fallback shim: file-not-found → serve index.html at 200.
- Commit dist/.gitkeep and dist/index.html (placeholder) so go build
  works on a fresh clone; real build output stays gitignored.
- Mount web.Handler() as GET /* catch-all in server.go after /api/v1
  so API routes and probe endpoints shadow the wildcard.
- Add three server tests: ServesSPAAtRoot, SPAFallbackForNonAPIPath,
  APIPathsBypassSPA; update NotFoundReturnsProblemJSON for SPA era.
- Extend Justfile with web-{install,dev,build,test,lint,clean} targets;
  build now depends on web-build.
- Add node:20-alpine web-builder stage to Dockerfile; COPY dist into
  the Go builder stage before compiling.