web: prune lethe_auth_failures log to the 5-min window on insert

server/web: fail loud when index.html lacks </head> for config injection

web: AuthGate consolidates three "not authenticated" cards

Create AuthGate component as the single source of truth for the
unauthenticated UI. Cold renders show a manual sign-in button (IV7);
mid-session expiry auto-redirects via useEffect (IV7); auth_error shows
the distinct error card with a "Try again" button and never auto-retries
(IV6). Swap the inline AuthError cards at index, projects, and
SavedSearchesSection call sites.

web: /login + /auth/callback routes + auth context + config reader

- web/src/lib/config.ts: readConfig() reads window.__LETHE_CONFIG__ (IF1),
  converts client_id -> clientId, throws on absent config (GPC6)
- web/src/lib/authContext.tsx: AuthProvider subscribes to tokenStore, parses
  ID token name claim, exposes signIn/signOut/reportAuthError via context;
  hasBeenAuthenticated flag supports IV7 cold-vs-session distinction
- web/src/routes/login.tsx: /login route calls signIn(return_to) on mount
- web/src/routes/auth.callback.tsx: validates state+TTL, exchanges code via
  raw fetch to OP /token (allowed exception), stores access_token via
  tokenStore.set, anti-loop guard using countCallbackFailures (IV6)
- web/src/routes/__root.tsx: wraps tree in AuthProvider above
  KeyboardCursorContext
- web/src/routeTree.gen.ts: regenerated by Vite with /login and /auth/callback
- internal/server/web/dist/index.html: rebuilt artifact with new asset hashes

server/web: tag Config fields for snake_case JSON output (IF1 contract)

oidcstub: implement /authorize + /token auth-code+PKCE; inject window.__LETHE_CONFIG__ into SPA

web: palette — gate prefetch with enabled+staleTime per plan 4.2

web: palette items — projects, sessions, saved searches

Extend the command palette with three new item kinds (project, session,
saved) backed by unconditional TanStack Query hooks. Items are grouped in
fixed order (jump → projects → sessions → saved) with section headers;
fire() dispatches kind-aware navigation; .palette-group-head CSS added.

web: sectioned /settings with saved-searches CRUD

Add four TanStack Query hooks (useSavedSearches, useCreateSavedSearch,
useUpdateSavedSearch, useDeleteSavedSearch) backed by IF3 contract.
Introduce apiFetchVoid in client.ts for the 204 No Content DELETE path.
Replace the placeholder /settings route with a two-column sectioned shell
(SectionRail + SavedSearchesSection); Display section is disabled pending #8.

web: add lambda favicon (svg + ico + apple-touch-icon)

Introduces the project mark — a Greek capital lambda Λ (initial of
Λήθη / Lethe) standing above a stylized rust ripple on a deep ink
plate. Reads as a glyph at 16 px; the ripple and inner rim emerge
at 32 px and above.

Three formats are shipped via web/public/ so Vite copies them
verbatim into the embedded dist bundle:

  - favicon.svg          canonical 64x64 vector source
  - favicon.ico          16/32/48 multi-resolution legacy fallback
  - apple-touch-icon.png 180x180 iOS home-screen bookmark

The ICO and PNG were rasterized from the SVG with rsvg-convert
(ImageMagick's built-in MSVG renderer drops strokes); magick is
only used to assemble the multi-image ICO container.

The dist/ placeholder index.html is regenerated alongside so a
fresh clone that hasn't run web-build yet still serves the icon
links from the committed fallback HTML.

web: review fixes for projects/stats SPA routes

- ProjectsTable: drop the inner navigate call from handleOpen;
  the parent route already navigates via the onOpen callback,
  so the second push was creating a duplicate history entry
  on every row click. Matches the SessionsTable pattern.

- HorizontalBars: replace href:string with onActivate(row)
  callback. The earlier shape passed a pre-encoded path
  string straight into TanStack <Link to={...}>; routing the
  navigation through the typed (to, params) form via the
  caller avoids any double-encoding ambiguity around splat
  params and decouples the primitive from a specific route.

- stats.css: drop duplicated .card / .card-head / .card-body
  blocks. The same rules already live in shell.css (loaded
  globally), so any future divergence between the two copies
  would silently desync.

web: regenerate embedded SPA bundle for stats route

Vite stamps content-hash asset filenames; the Phase 5 source changes
flipped both bundle hashes. The Phase 5 commit (e048bdf) shipped the
source but not the regenerated index.html, which the Go server embeds
via embed.FS to serve the SPA. Re-stage so the embedded asset path
matches the actual bundle on disk.

web: project detail route scoped via ?cwd= sessions filter

web: projects index route with real /projects data

web: session view with turn list and transcript

Phase 6: replace the placeholder session route with the real implementation.
Adds useSession hook (TanStack Query), TurnList aside, Transcript with
react-markdown rendering, session.css, and the updated session route with
SubBar breadcrumb, error/loading states, and turn selection/scroll.

web: home route with real session list, filters, keyboard cursor

- api/client.ts: apiFetch with AuthError/APIError, 401 and problem+json handling
- api/adapters.ts: SessionDTO→Session adapter with composite id and epoch conversion
- api/adapters.test.ts: 6 TDD tests covering all specified edge cases
- features/home/useSessions.ts: TanStack Query hook with since/tool/host params
- features/home/FilterChips.tsx: chip-bar with popovers, Esc/outside-click dismiss
- features/home/SessionsTable.tsx: grid table with cursor row highlight, formatStarted/formatTok
- features/home/useHomeCursor.ts: cursor hook with move/activate/jumpTo
- routes/index.tsx: Home route wired to real data, URL-driven filters, keyboard cursor
- routes/__root.tsx: cursorRef + KeyboardCursorContext for route-local cursor registration
- routes/session.$tool.$host.$id.tsx: stub for Phase 6
- styles/home.css: .home-table/.home-thead/.home-row/.home-row.cursor grid rules
- primitives/ToolDot.tsx: widened tool prop to string (Tool type is open-ended)

web: shell, theme, keyboard, stub routes, palette skeleton

- lib/theme.ts: bootstrapTheme() + setTheme() with OS/localStorage sync
- lib/keyboard.ts: g-prefix nav, j/k cursor, ⌘K palette, Esc, Enter
- lib/theme.test.ts + lib/keyboard.test.ts: 26 vitest tests (TDD)
- shell/TopBar.tsx: brand crumb, search trigger, tab nav using router pathname
- shell/SubBar.tsx: slot component with optional right section
- shell/Palette.tsx: modal overlay, JUMP items, synthetic SEARCH row
- styles/shell.css + styles/palette.css: ported verbatim from prototype.css
- routes/__root.tsx: wires TopBar, Outlet, Palette, keyboard controller, bootstrapTheme
- routes/index.tsx + projects/stats/health/settings/search.tsx: EmptyState stubs
- main.tsx: replace scaffold div with RouterProvider
- vitest.config.ts: add jsdom url for localStorage support (Node 25 compat)

server: embed web SPA at /, wire build pipeline

- Add internal/server/web/embed.go with //go:embed all:dist and a
  SPA fallback shim: file-not-found → serve index.html at 200.
- Commit dist/.gitkeep and dist/index.html (placeholder) so go build
  works on a fresh clone; real build output stays gitignored.
- Mount web.Handler() as GET /* catch-all in server.go after /api/v1
  so API routes and probe endpoints shadow the wildcard.
- Add three server tests: ServesSPAAtRoot, SPAFallbackForNonAPIPath,
  APIPathsBypassSPA; update NotFoundReturnsProblemJSON for SPA era.
- Extend Justfile with web-{install,dev,build,test,lint,clean} targets;
  build now depends on web-build.
- Add node:20-alpine web-builder stage to Dockerfile; COPY dist into
  the Go builder stage before compiling.