feat(api): server-rendered Jinja2 Runtime console at /ui/

Replaces the separate Vue/Vite `console/` SPA with a same-origin,
server-rendered console built on a module-level Jinja2 Environment
with select_autoescape(["html","xml"]).

- Add api/console_web.py with /ui/ routes (dashboard, tasks, task
  detail/timeline, config) and a _status_fragment polled every 10s.
- Refactor api/console.py into a typed ConsoleService shared by the
  JSON and HTML routers so validation/persistence cannot drift.
- Remove RUNTIME_CONSOLE_STATIC_DIR, SpaStaticFiles, and the wildcard
  CORS middleware from api/rest.py; GET / now redirects to /ui/.
- Delete the top-level console/ project; add jinja2 and python-multipart
  as direct dependencies and ship templates/CSS/JS via package-data.
- Add 31 tests (XSS probes, PRG flows, fragment refresh, no-static-dir
  and no-CORS regressions, wheel-packaging smoke test).

/console/* JSON endpoints remain unchanged. The console keeps the
trusted-network-only boundary; auth/CSRF is intentionally deferred.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/templates/runtime_console/dashboard.html

@@ -0,0 +1,17 @@
+{% extends "base.html" %}
+{% block title %}Devices · Apex Console{% endblock %}
+{% block body %}
+<header class="topbar">
+  <div>
+    <h1>Devices</h1>
+    <p>{{ device_count }} device(s) / {{ task_count }} task(s)</p>
+  </div>
+</header>
+
+<section class="view-grid">
+  <div id="live-status">
+    {% include "_status_fragment.html" %}
+  </div>
+</section>
+<script src="{{ url_for('runtime_console_assets', path='dashboard.js') }}"></script>
+{% endblock %}