feat(cloud-console): task listing, attempt history, CORS, and console SPA

Implements the cloud-console OpenSpec change: adds GET /v1/tasks (filterable,
bounded pagination, tasks:read) and GET /v1/tasks/{id}/attempts (404 on unknown
task) to the platform SDK, with matching CloudClient methods and a closed-by-
default CLOUD_CONSOLE_CORS_ORIGINS allow-list wired through CloudControlConfig.
Ships an independent Vue 3 + Vite SPA at cloud-console/ that authenticates with
an operator-supplied bearer token held in sessionStorage, renders tasks with
attempt history, device pool, host registry, and the plugin registry with a
registration form.

Backend test suite: 438 passed (-m "not integration"); cloud-console typecheck
and production build both succeed. PostgreSQL-backed repository tests and
manual end-to-end verification remain pending external infrastructure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_cloud_client.py

@@ -150,6 +150,8 @@ def test_client_applies_bearer_token_to_every_public_method(tmp_path) -> None:
 
     task_id = client.submit_task(goal="authenticated")["task_id"]
     assert client.get_task_status(task_id)["status"] == "queued"
+    assert client.list_tasks()["total"] == 1
+    assert client.get_task_attempts(task_id) == []
     assert client.list_devices() == []
     assert client.list_hosts() == []
     assert client.list_plugins() == []
@@ -164,6 +166,74 @@ def test_client_applies_bearer_token_to_every_public_method(tmp_path) -> None:
     )
 
 
+def test_client_list_tasks_and_get_attempts_match_direct_http(tmp_path) -> None:
+    from datetime import UTC, datetime
+
+    from core.models import Device
+
+    client, pool = _client_and_pool(tmp_path)
+    pool.sync_host_devices(
+        "host-a",
+        [Device(id="dev-a", driver_type="wda", status="idle")],  # type: ignore[arg-type]
+    )
+    first_id = client.submit_task(goal="first")["task_id"]
+    second_id = client.submit_task(goal="second")["task_id"]
+
+    # Drive one task through an attempt so get_task_attempts has data.
+    scheduler = TaskScheduler(pool, CloudStore(tmp_path / "cloud.sqlite3"), _config())
+    scheduler.assign()
+    task = scheduler.store.get_task(first_id)
+    if task is not None and task.status == "assigned":
+        scheduler.store.record_task_result(
+            task_id=first_id,
+            attempt=task.attempt_count,
+            lease_id=task.lease_id or "",
+            host_id=task.assigned_host_id or "",
+            status="failed",
+            failure_reason="boom",
+            terminal_result={"exit_code": 1},
+            completed_at=datetime.now(UTC),
+        )
+
+    # The TestClient is the HTTP boundary — issuing direct calls through it
+    # exercises the same FastAPI routes the client does, which is the parity
+    # contract platform-sdk already relies on.
+    http_client = client._http  # type: ignore[attr-defined]
+    direct_list = http_client.get(
+        client._url("/tasks"),  # type: ignore[attr-defined]
+        params={"limit": 50, "offset": 0},
+        headers=client._headers,  # type: ignore[attr-defined]
+    ).json()
+    direct_attempts = http_client.get(
+        f"{client._url('/tasks')}/{first_id}/attempts",  # type: ignore[attr-defined]
+        headers=client._headers,  # type: ignore[attr-defined]
+    ).json()
+
+    via_client = client.list_tasks()
+    assert via_client == direct_list
+    assert via_client["total"] == 2
+    # Most-recent-first: second (the newer) before first.
+    assert [item["id"] for item in via_client["items"]] == [second_id, first_id]
+
+    failed_only = client.list_tasks(status="failed")
+    assert failed_only["total"] == 1
+    assert failed_only["items"][0]["id"] == first_id
+
+    attempts = client.get_task_attempts(first_id)
+    assert attempts == direct_attempts
+    assert len(attempts) == 1
+    assert attempts[0]["status"] == "failed"
+    assert attempts[0]["failure_reason"] == "boom"
+
+
+def test_client_get_attempts_raises_for_unknown_task(tmp_path) -> None:
+    import httpx
+
+    client, _ = _client_and_pool(tmp_path)
+    with pytest.raises(httpx.HTTPStatusError):
+        client.get_task_attempts("does-not-exist")
+
+
 def test_client_raises_typed_authorization_error_without_exposing_token(
     tmp_path,
 ) -> None: