feat(api): server-rendered Jinja2 Runtime console at /ui/

Replaces the separate Vue/Vite `console/` SPA with a same-origin,
server-rendered console built on a module-level Jinja2 Environment
with select_autoescape(["html","xml"]).

- Add api/console_web.py with /ui/ routes (dashboard, tasks, task
  detail/timeline, config) and a _status_fragment polled every 10s.
- Refactor api/console.py into a typed ConsoleService shared by the
  JSON and HTML routers so validation/persistence cannot drift.
- Remove RUNTIME_CONSOLE_STATIC_DIR, SpaStaticFiles, and the wildcard
  CORS middleware from api/rest.py; GET / now redirects to /ui/.
- Delete the top-level console/ project; add jinja2 and python-multipart
  as direct dependencies and ship templates/CSS/JS via package-data.
- Add 31 tests (XSS probes, PRG flows, fragment refresh, no-static-dir
  and no-CORS regressions, wheel-packaging smoke test).

/console/* JSON endpoints remain unchanged. The console keeps the
trusted-network-only boundary; auth/CSRF is intentionally deferred.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

pyproject.toml

@@ -8,10 +8,12 @@ dependencies = [
     "Appium-Python-Client>=5.1.1",
     "fastapi>=0.115.0",
     "httpx>=0.27.0",
+    "jinja2>=3.1",
     "mcp>=1.27,<2",
     "openai>=1.0.0",
     "paddlepaddle>=3.0.0",
     "paddleocr>=3.0.0",
+    "python-multipart>=0.0.20",
     "uvicorn[standard]>=0.30.0",
 ]
 
@@ -53,6 +55,13 @@ include = [
     "workflow*",
 ]
 
+[tool.setuptools.package-data]
+api = [
+    "templates/runtime_console/*.html",
+    "static/runtime_console/*.css",
+    "static/runtime_console/*.js",
+]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 addopts = "-ra --import-mode=importlib"