feat(api): server-rendered Jinja2 Runtime console at /ui/

Replaces the separate Vue/Vite `console/` SPA with a same-origin,
server-rendered console built on a module-level Jinja2 Environment
with select_autoescape(["html","xml"]).

- Add api/console_web.py with /ui/ routes (dashboard, tasks, task
  detail/timeline, config) and a _status_fragment polled every 10s.
- Refactor api/console.py into a typed ConsoleService shared by the
  JSON and HTML routers so validation/persistence cannot drift.
- Remove RUNTIME_CONSOLE_STATIC_DIR, SpaStaticFiles, and the wildcard
  CORS middleware from api/rest.py; GET / now redirects to /ui/.
- Delete the top-level console/ project; add jinja2 and python-multipart
  as direct dependencies and ship templates/CSS/JS via package-data.
- Add 31 tests (XSS probes, PRG flows, fragment refresh, no-static-dir
  and no-CORS regressions, wheel-packaging smoke test).

/console/* JSON endpoints remain unchanged. The console keeps the
trusted-network-only boundary; auth/CSRF is intentionally deferred.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/rest.py

@@ -1,8 +1,7 @@
-import os
-from pathlib import Path
 from typing import Any
 
-from api.console import create_console_router
+from api.console import ConsoleService, create_console_router
+from api.console_web import create_console_web_router, mount_console_assets
 from api.errors import semantic_error
 from core.models import Task
 from device.manager import DEFAULT_MANAGER, DeviceManager
@@ -26,28 +25,8 @@ def create_app(
     timeline: Timeline | None = None,
 ) -> Any:
     from fastapi import BackgroundTasks, FastAPI, HTTPException
-    from fastapi.middleware.cors import CORSMiddleware
     from fastapi.responses import RedirectResponse
-    from fastapi.staticfiles import StaticFiles
     from pydantic import BaseModel
-    from starlette.exceptions import HTTPException as StarletteHTTPException
-    from starlette.types import Scope
-
-    class SpaStaticFiles(StaticFiles):
-        """``StaticFiles`` variant that falls back to ``index.html`` for SPA routes.
-
-        Mirrors ``apps/cloud-api/cloud_api/app.py``'s implementation: an unknown
-        path like ``/ui/tasks/abc`` would otherwise 404 instead of letting the
-        SPA's client-side router handle it.
-        """
-
-        async def get_response(self, path: str, scope: Scope) -> Any:
-            try:
-                return await super().get_response(path, scope)
-            except StarletteHTTPException as exc:
-                if exc.status_code == 404 and path != "index.html":
-                    return await super().get_response("index.html", scope)
-                raise
 
     device_manager = manager or DEFAULT_MANAGER
     store = metadata_store or TaskMetadataStore()
@@ -63,12 +42,6 @@ def create_app(
     )
     _apply_max_steps(runner, max_steps)
     app = FastAPI(title="Apex Agent API")
-    app.add_middleware(
-        CORSMiddleware,
-        allow_origins=["*"],
-        allow_methods=["*"],
-        allow_headers=["*"],
-    )
 
     class TapRequest(BaseModel):
         x: float
@@ -85,6 +58,18 @@ def create_app(
         goal: str
         device_id: str
 
+    console_service = ConsoleService(
+        device_manager=device_manager,
+        metadata_store=store,
+        timeline=timeline_store,
+        config_store=config_store,
+        task_runner=runner,
+    )
+
+    @app.get("/", include_in_schema=False)
+    def root() -> RedirectResponse:
+        return RedirectResponse(url="/ui/")
+
     @app.get("/devices")
     def devices() -> list[dict[str, Any]]:
         return [device.to_dict() for device in device_manager.list_devices()]
@@ -139,33 +124,9 @@ def create_app(
             raise HTTPException(status_code=404, detail="task not found")
         return task
 
-    app.include_router(
-        create_console_router(
-            device_manager=device_manager,
-            metadata_store=store,
-            timeline=timeline_store,
-            config_store=config_store,
-            task_runner=runner,
-        )
-    )
-
-    console_static_dir = os.environ.get("RUNTIME_CONSOLE_STATIC_DIR")
-    if console_static_dir:
-        dist_dir = Path(console_static_dir)
-        if not dist_dir.is_dir():
-            raise ValueError(
-                f"RUNTIME_CONSOLE_STATIC_DIR is not a directory: {dist_dir}"
-            )
-
-        @app.get("/", include_in_schema=False)
-        async def _redirect_to_console() -> RedirectResponse:
-            return RedirectResponse(url="/ui/")
-
-        app.mount(
-            "/ui",
-            SpaStaticFiles(directory=str(dist_dir), html=True),
-            name="console",
-        )
+    app.include_router(create_console_router(console_service))
+    app.include_router(create_console_web_router(console_service))
+    mount_console_assets(app)
 
     return app