feat(api): server-rendered Jinja2 Runtime console at /ui/

Replaces the separate Vue/Vite `console/` SPA with a same-origin,
server-rendered console built on a module-level Jinja2 Environment
with select_autoescape(["html","xml"]).

- Add api/console_web.py with /ui/ routes (dashboard, tasks, task
  detail/timeline, config) and a _status_fragment polled every 10s.
- Refactor api/console.py into a typed ConsoleService shared by the
  JSON and HTML routers so validation/persistence cannot drift.
- Remove RUNTIME_CONSOLE_STATIC_DIR, SpaStaticFiles, and the wildcard
  CORS middleware from api/rest.py; GET / now redirects to /ui/.
- Delete the top-level console/ project; add jinja2 and python-multipart
  as direct dependencies and ship templates/CSS/JS via package-data.
- Add 31 tests (XSS probes, PRG flows, fragment refresh, no-static-dir
  and no-CORS regressions, wheel-packaging smoke test).

/console/* JSON endpoints remain unchanged. The console keeps the
trusted-network-only boundary; auth/CSRF is intentionally deferred.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/CONSTITUTION.md

@@ -48,8 +48,11 @@ owned by `packages/cloud-platform` and may depend on the Runtime through an
 explicit workspace source; the Runtime distribution must never depend on or
 package `cloud`.
 
-All Python members share the committed root `uv.lock`. The Vue/Vite `console/`
-remains outside the Python workspace and keeps its independent npm lifecycle.
+All Python members share the committed root `uv.lock`. The Runtime operator
+console is server-rendered by the `api` layer through Jinja2 templates and
+static assets packaged with `device-agent-runtime`; there is no separate
+frontend project or Node build step for the Runtime console. The unrelated
+`cloud-console/` Vue/Vite application keeps its own independent npm lifecycle.
 
 ## Change Discipline
 

docs/MACOS_IPHONE_SETUP.md

@@ -331,23 +331,19 @@ curl -s -X POST http://127.0.0.1:8000/devices/iphone-1/launch \
 点击坐标必须按当前设备屏幕坐标选择。先截图或使用 Appium Inspector 确认坐标，避免
 误操作。
 
-如需启动 Web Console，保持 Runtime API 运行，再在第三个 Terminal 执行：
+Runtime API 自带同源 Web Console，无需额外的前端进程、Node 工具链或
+`RUNTIME_CONSOLE_STATIC_DIR`。保持 Runtime API 运行，浏览器访问
+`http://127.0.0.1:8000/`（会自动 307 跳转到 `/ui/`）即可：
 
-```bash
-cd console
-npm install
-npm run dev
-```
+- `/ui/`：设备状态面板，约每 10 秒自动刷新一次；
+- `/ui/tasks`：任务列表与筛选；
+- `/ui/tasks/{task_id}`：任务详情与逐步 timeline（含截图）；
+- `/ui/config`：登记/移除设备、调整 `max_steps`。
 
-Console 默认连接 `http://127.0.0.1:8000`。已由上面启动脚本连接的
-`iphone-1` 会出现在设备列表中。不要在 Console 中重复登记同一台设备；当前登记
-操作只写入配置，不会自动 connect。
-
-如果不想为 Console 单独起一个 `npm run dev` 进程，可以改为一次性构建后交给
-Runtime API 同源托管，见 `console/README.md` 的「Same-Origin, Single-Process
-Mode」一节：设置 `VITE_API_BASE_URL=` 构建，再用 `RUNTIME_CONSOLE_STATIC_DIR`
-指向构建产物启动 Runtime API，浏览器访问 `/ui/` 即可；改前端代码后需要重新
-`npm run build`，不支持热更新。
+已由上面启动脚本连接的 `iphone-1` 会出现在设备列表中。不要在 Console 中
+重复登记同一台设备；当前登记操作只写入配置，不会自动 connect。Console 与
+`/console/*` JSON API 共用同一份 Runtime 状态，两者行为一致。Runtime Console
+仅假设受信任本地网络访问，不提供鉴权 / CSRF；如需暴露到非受信网络请另行评估。
 
 ## 9. 启动云端受管 Host Agent