feat(cloud-console): task listing, attempt history, CORS, and console SPA

Implements the cloud-console OpenSpec change: adds GET /v1/tasks (filterable,
bounded pagination, tasks:read) and GET /v1/tasks/{id}/attempts (404 on unknown
task) to the platform SDK, with matching CloudClient methods and a closed-by-
default CLOUD_CONSOLE_CORS_ORIGINS allow-list wired through CloudControlConfig.
Ships an independent Vue 3 + Vite SPA at cloud-console/ that authenticates with
an operator-supplied bearer token held in sessionStorage, renders tasks with
attempt history, device pool, host registry, and the plugin registry with a
registration form.

Backend test suite: 438 passed (-m "not integration"); cloud-console typecheck
and production build both succeed. PostgreSQL-backed repository tests and
manual end-to-end verification remain pending external infrastructure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_cloud_repository_contract.py

@@ -73,6 +73,8 @@ def test_cloud_repository_exposes_crud_and_atomic_lease_operations() -> None:
         "list_devices",
         "enqueue_task",
         "get_task",
+        "list_tasks",
+        "count_tasks",
         "save_plugin",
         "assign_task",
         "claim_assignment",
@@ -453,6 +455,105 @@ def test_task_attempt_history_is_ordered_and_complete(database_url: str) -> None
         database.close()
 
 
+def test_list_tasks_returns_empty_when_repository_has_no_tasks(
+    database_url: str,
+) -> None:
+    database = CloudDatabase(database_url)
+    try:
+        assert database.repository.list_tasks() == []
+        assert database.repository.count_tasks() == 0
+        assert database.repository.list_tasks(status="queued") == []
+        assert database.repository.count_tasks(status="queued") == 0
+    finally:
+        database.close()
+
+
+def test_list_tasks_returns_most_recent_first_with_optional_status_filter(
+    database_url: str,
+) -> None:
+    database = CloudDatabase(database_url)
+    base = datetime(2026, 7, 12, 6, 0, tzinfo=UTC)
+    queued_ids = [_unique_id("list-task") for _ in range(2)]
+    failed_ids = [_unique_id("list-task") for _ in range(2)]
+
+    try:
+        for index, task_id in enumerate(queued_ids):
+            database.repository.enqueue_task(
+                ScheduledTask(
+                    id=task_id,
+                    goal="queued goal",
+                    workflow_definition_id=None,
+                    constraints=TaskConstraints(),
+                    status="queued",
+                    created_at=base + timedelta(seconds=index),
+                )
+            )
+        for index, task_id in enumerate(failed_ids):
+            database.repository.enqueue_task(
+                ScheduledTask(
+                    id=task_id,
+                    goal="failed goal",
+                    workflow_definition_id=None,
+                    constraints=TaskConstraints(),
+                    status="failed",
+                    failure_reason="boom",
+                    created_at=base + timedelta(seconds=10 + index),
+                )
+            )
+
+        unfiltered = database.repository.list_tasks()
+        assert [task.id for task in unfiltered] == (
+            list(reversed(failed_ids)) + list(reversed(queued_ids))
+        )
+        assert database.repository.count_tasks() == 4
+
+        queued = database.repository.list_tasks(status="queued")
+        assert [task.id for task in queued] == list(reversed(queued_ids))
+        assert all(task.status == "queued" for task in queued)
+        assert database.repository.count_tasks(status="queued") == 2
+
+        failed = database.repository.list_tasks(status="failed")
+        assert [task.id for task in failed] == list(reversed(failed_ids))
+        assert database.repository.count_tasks(status="failed") == 2
+
+        # A status with no matches returns an empty page and zero count.
+        assert database.repository.list_tasks(status="done") == []
+        assert database.repository.count_tasks(status="done") == 0
+    finally:
+        database.close()
+
+
+def test_list_tasks_pagination_bounds(database_url: str) -> None:
+    database = CloudDatabase(database_url)
+    base = datetime(2026, 7, 12, 7, 0, tzinfo=UTC)
+    task_ids = [_unique_id("page-task") for _ in range(4)]
+
+    try:
+        for index, task_id in enumerate(task_ids):
+            database.repository.enqueue_task(
+                ScheduledTask(
+                    id=task_id,
+                    goal=f"goal-{index}",
+                    workflow_definition_id=None,
+                    constraints=TaskConstraints(),
+                    created_at=base + timedelta(seconds=index),
+                )
+            )
+
+        # Most-recent-first ordering means page 1 returns the newest two ids.
+        page_one = database.repository.list_tasks(limit=2, offset=0)
+        assert [task.id for task in page_one] == [task_ids[3], task_ids[2]]
+
+        page_two = database.repository.list_tasks(limit=2, offset=2)
+        assert [task.id for task in page_two] == [task_ids[1], task_ids[0]]
+
+        # An offset past the end of the result set returns an empty page,
+        # not an error — the caller is expected to consult count_tasks().
+        assert database.repository.list_tasks(limit=10, offset=100) == []
+    finally:
+        database.close()
+
+
 def test_atomic_assignment_creates_lease_attempt_and_reservation(
     database_url: str,
 ) -> None: