feat(cloud-console): task listing, attempt history, CORS, and console SPA

Implements the cloud-console OpenSpec change: adds GET /v1/tasks (filterable,
bounded pagination, tasks:read) and GET /v1/tasks/{id}/attempts (404 on unknown
task) to the platform SDK, with matching CloudClient methods and a closed-by-
default CLOUD_CONSOLE_CORS_ORIGINS allow-list wired through CloudControlConfig.
Ships an independent Vue 3 + Vite SPA at cloud-console/ that authenticates with
an operator-supplied bearer token held in sessionStorage, renders tasks with
attempt history, device pool, host registry, and the plugin registry with a
registration form.

Backend test suite: 438 passed (-m "not integration"); cloud-console typecheck
and production build both succeed. PostgreSQL-backed repository tests and
manual end-to-end verification remain pending external infrastructure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_cloud_sdk_api.py

@@ -272,6 +272,8 @@ def test_submit_with_constraints(tmp_path) -> None:
     [
         ("post", "/v1/tasks", {"goal": "x"}, "tasks:submit"),
         ("get", "/v1/tasks/missing", None, "tasks:read"),
+        ("get", "/v1/tasks", None, "tasks:read"),
+        ("get", "/v1/tasks/missing/attempts", None, "tasks:read"),
         ("get", "/v1/devices", None, "pool:read"),
         ("get", "/v1/hosts", None, "pool:read"),
         ("get", "/v1/plugins", None, "plugins:read"),
@@ -332,6 +334,102 @@ def test_every_public_route_enforces_its_scope(
     assert authorized.status_code not in {401, 403}
 
 
+def test_list_tasks_returns_summary_with_pagination_and_status_filter(
+    tmp_path,
+) -> None:
+    app, pool, scheduler, _ = _build_app(tmp_path)
+    # Submit three tasks; assign one so the population covers multiple statuses.
+    first_id = scheduler.submit(goal="first")
+    second_id = scheduler.submit(goal="second")
+    pool.sync_host_devices(
+        "host-a",
+        [Device(id="device-a", driver_type="wda", status="idle")],  # type: ignore[arg-type]
+    )
+    scheduler.assign()
+    # assigned_id is whichever task the scheduler picked (oldest-first = first_id).
+    assigned_id = first_id
+
+    client = _client_for(app)
+
+    unfiltered = client.get("/v1/tasks").json()
+    assert unfiltered["total"] == 2
+    assert unfiltered["limit"] == 50
+    assert unfiltered["offset"] == 0
+    assert [item["id"] for item in unfiltered["items"]] == [second_id, assigned_id]
+    # Lease id must not leak through the summary surface.
+    assert all("lease_id" not in item for item in unfiltered["items"])
+
+    queued_only = client.get("/v1/tasks", params={"status": "queued"}).json()
+    assert queued_only["total"] == 1
+    assert [item["id"] for item in queued_only["items"]] == [second_id]
+    assert all(item["status"] == "queued" for item in queued_only["items"])
+
+    assigned_only = client.get(
+        "/v1/tasks", params={"status": "assigned"}
+    ).json()
+    assert assigned_only["total"] == 1
+    assert [item["id"] for item in assigned_only["items"]] == [assigned_id]
+
+
+def test_list_tasks_rejects_page_size_above_maximum(tmp_path) -> None:
+    app, _, _, _ = _build_app(tmp_path)
+    client = _client_for(app)
+
+    too_large = client.get("/v1/tasks", params={"limit": 101})
+    assert too_large.status_code == 422
+    # And the boundary value is accepted.
+    boundary = client.get("/v1/tasks", params={"limit": 100})
+    assert boundary.status_code == 200
+
+
+def test_list_tasks_rejects_negative_offset(tmp_path) -> None:
+    app, _, _, _ = _build_app(tmp_path)
+    client = _client_for(app)
+    response = client.get("/v1/tasks", params={"offset": -1})
+    assert response.status_code == 422
+
+
+def test_list_task_attempts_returns_chronological_history(tmp_path) -> None:
+    app, pool, scheduler, _ = _build_app(tmp_path)
+    pool.sync_host_devices(
+        "host-a",
+        [Device(id="device-a", driver_type="wda", status="idle")],  # type: ignore[arg-type]
+    )
+    task_id = scheduler.submit(goal="attempt me")
+    scheduler.assign()
+    task = scheduler.store.get_task(task_id)
+    scheduler.store.record_task_result(
+        task_id=task_id,
+        attempt=task.attempt_count,
+        lease_id=task.lease_id or "",
+        host_id=task.assigned_host_id or "",
+        status="failed",
+        failure_reason="boom",
+        terminal_result={"exit_code": 1},
+        completed_at=datetime.now(UTC),
+    )
+
+    client = _client_for(app)
+    resp = client.get(f"/v1/tasks/{task_id}/attempts")
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert len(body) == 1
+    assert body[0]["task_id"] == task_id
+    assert body[0]["status"] == "failed"
+    assert body[0]["failure_reason"] == "boom"
+    assert body[0]["terminal_result"] == {"exit_code": 1}
+    assert body[0]["host_id"] == "host-a"
+    assert body[0]["device_id"] == "device-a"
+
+
+def test_list_task_attempts_returns_404_for_unknown_task(tmp_path) -> None:
+    app, _, _, _ = _build_app(tmp_path)
+    client = _client_for(app)
+    resp = client.get("/v1/tasks/does-not-exist/attempts")
+    assert resp.status_code == 404, resp.text
+    assert "does-not-exist" in resp.json()["detail"]
+
+
 def test_plugin_admin_scope_is_checked_before_registration(
     tmp_path,
     monkeypatch,