feat(cloud-console): task listing, attempt history, CORS, and console SPA

Implements the cloud-console OpenSpec change: adds GET /v1/tasks (filterable,
bounded pagination, tasks:read) and GET /v1/tasks/{id}/attempts (404 on unknown
task) to the platform SDK, with matching CloudClient methods and a closed-by-
default CLOUD_CONSOLE_CORS_ORIGINS allow-list wired through CloudControlConfig.
Ships an independent Vue 3 + Vite SPA at cloud-console/ that authenticates with
an operator-supplied bearer token held in sessionStorage, renders tasks with
attempt history, device pool, host registry, and the plugin registry with a
registration form.

Backend test suite: 438 passed (-m "not integration"); cloud-console typecheck
and production build both succeed. PostgreSQL-backed repository tests and
manual end-to-end verification remain pending external infrastructure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/cloud-platform/cloud/repository.py

@@ -7,7 +7,7 @@ from typing import TYPE_CHECKING, Any, Literal, Protocol
 if TYPE_CHECKING:
     from cloud.plugins import PluginManifest
     from cloud.pool import HostRegistration, PooledDevice
-    from cloud.scheduler import ScheduledTask
+    from cloud.scheduler import ScheduledTask, ScheduledTaskStatus
 
 
 AttemptStatus = Literal["assigned", "dispatched", "done", "failed", "expired"]
@@ -154,6 +154,16 @@ class CloudRepository(Protocol):
 
     def list_queued_tasks(self) -> list[ScheduledTask]: ...
 
+    def list_tasks(
+        self,
+        *,
+        status: ScheduledTaskStatus | None = None,
+        limit: int = 50,
+        offset: int = 0,
+    ) -> list[ScheduledTask]: ...
+
+    def count_tasks(self, status: ScheduledTaskStatus | None = None) -> int: ...
+
     def get_task(self, task_id: str) -> ScheduledTask | None: ...
 
     def update_task(