feat(api): server-rendered Jinja2 Runtime console at /ui/

Replaces the separate Vue/Vite `console/` SPA with a same-origin,
server-rendered console built on a module-level Jinja2 Environment
with select_autoescape(["html","xml"]).

- Add api/console_web.py with /ui/ routes (dashboard, tasks, task
  detail/timeline, config) and a _status_fragment polled every 10s.
- Refactor api/console.py into a typed ConsoleService shared by the
  JSON and HTML routers so validation/persistence cannot drift.
- Remove RUNTIME_CONSOLE_STATIC_DIR, SpaStaticFiles, and the wildcard
  CORS middleware from api/rest.py; GET / now redirects to /ui/.
- Delete the top-level console/ project; add jinja2 and python-multipart
  as direct dependencies and ship templates/CSS/JS via package-data.
- Add 31 tests (XSS probes, PRG flows, fragment refresh, no-static-dir
  and no-CORS regressions, wheel-packaging smoke test).

/console/* JSON endpoints remain unchanged. The console keeps the
trusted-network-only boundary; auth/CSRF is intentionally deferred.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/CONSTITUTION.md

@@ -48,8 +48,11 @@ owned by `packages/cloud-platform` and may depend on the Runtime through an
 explicit workspace source; the Runtime distribution must never depend on or
 package `cloud`.
 
-All Python members share the committed root `uv.lock`. The Vue/Vite `console/`
-remains outside the Python workspace and keeps its independent npm lifecycle.
+All Python members share the committed root `uv.lock`. The Runtime operator
+console is server-rendered by the `api` layer through Jinja2 templates and
+static assets packaged with `device-agent-runtime`; there is no separate
+frontend project or Node build step for the Runtime console. The unrelated
+`cloud-console/` Vue/Vite application keeps its own independent npm lifecycle.
 
 ## Change Discipline