feat(api): server-rendered Jinja2 Runtime console at /ui/

Replaces the separate Vue/Vite `console/` SPA with a same-origin,
server-rendered console built on a module-level Jinja2 Environment
with select_autoescape(["html","xml"]).

- Add api/console_web.py with /ui/ routes (dashboard, tasks, task
  detail/timeline, config) and a _status_fragment polled every 10s.
- Refactor api/console.py into a typed ConsoleService shared by the
  JSON and HTML routers so validation/persistence cannot drift.
- Remove RUNTIME_CONSOLE_STATIC_DIR, SpaStaticFiles, and the wildcard
  CORS middleware from api/rest.py; GET / now redirects to /ui/.
- Delete the top-level console/ project; add jinja2 and python-multipart
  as direct dependencies and ship templates/CSS/JS via package-data.
- Add 31 tests (XSS probes, PRG flows, fragment refresh, no-static-dir
  and no-CORS regressions, wheel-packaging smoke test).

/console/* JSON endpoints remain unchanged. The console keeps the
trusted-network-only boundary; auth/CSRF is intentionally deferred.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/static/runtime_console/dashboard.js

@@ -0,0 +1,25 @@
+// Narrow server-rendered live-status enhancement. Fetches an HTML fragment
+// from the same origin and replaces only the dashboard live region. Does
+// not parse JSON, rebuild DOM from client state, or depend on any framework.
+(function () {
+  "use strict";
+  var region = document.getElementById("live-status");
+  if (!region) {
+    return;
+  }
+  setInterval(function () {
+    fetch("/ui/_status_fragment", { headers: { Accept: "text/html" } })
+      .then(function (response) {
+        if (!response.ok) {
+          throw new Error("fragment refresh failed");
+        }
+        return response.text();
+      })
+      .then(function (html) {
+        region.innerHTML = html;
+      })
+      .catch(function () {
+        // Ignore transient network errors; the next tick will retry.
+      });
+  }, 10000);
+})();