feat(api): server-rendered Jinja2 Runtime console at /ui/

Replaces the separate Vue/Vite `console/` SPA with a same-origin,
server-rendered console built on a module-level Jinja2 Environment
with select_autoescape(["html","xml"]).

- Add api/console_web.py with /ui/ routes (dashboard, tasks, task
  detail/timeline, config) and a _status_fragment polled every 10s.
- Refactor api/console.py into a typed ConsoleService shared by the
  JSON and HTML routers so validation/persistence cannot drift.
- Remove RUNTIME_CONSOLE_STATIC_DIR, SpaStaticFiles, and the wildcard
  CORS middleware from api/rest.py; GET / now redirects to /ui/.
- Delete the top-level console/ project; add jinja2 and python-multipart
  as direct dependencies and ship templates/CSS/JS via package-data.
- Add 31 tests (XSS probes, PRG flows, fragment refresh, no-static-dir
  and no-CORS regressions, wheel-packaging smoke test).

/console/* JSON endpoints remain unchanged. The console keeps the
trusted-network-only boundary; auth/CSRF is intentionally deferred.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_console_api.py

@@ -80,17 +80,18 @@ def test_console_status_endpoints_cover_empty_and_populated_states(tmp_path) ->
         "task-old",
     ]
     assert [
-        task["id"]
-        for task in client.get("/console/tasks?device_id=iphone-1").json()
+        task["id"] for task in client.get("/console/tasks?device_id=iphone-1").json()
     ] == ["task-old"]
-    assert [task["id"] for task in client.get("/console/tasks?status=running").json()] == [
-        "task-new"
-    ]
+    assert [
+        task["id"] for task in client.get("/console/tasks?status=running").json()
+    ] == ["task-new"]
     assert client.get("/console/tasks/task-old").json()["goal"] == "open settings"
     assert client.get("/console/tasks/missing").status_code == 404
 
 
-def test_console_timeline_inlines_screenshot_and_handles_empty_history(tmp_path) -> None:
+def test_console_timeline_inlines_screenshot_and_handles_empty_history(
+    tmp_path,
+) -> None:
     timeline = Timeline(ArtifactStore(tmp_path / "history"))
     client, metadata_store = _client(tmp_path, timeline=timeline)
     task = Task(id="task-1", goal="tap search", device_id="iphone-1")
@@ -193,3 +194,27 @@ def test_console_startup_reloads_persisted_devices_and_settings(tmp_path) -> Non
     assert runner.config.max_steps == 31
     assert [device.id for device in manager.list_devices()] == ["persisted-1"]
     assert client.get("/console/devices").json()[0]["name"] == "Persisted iPhone"
+
+
+def test_console_json_reflects_page_form_mutations(tmp_path) -> None:
+    """A device registered via the /ui/ form must be visible through /console/* JSON."""
+    config_store = DeviceConfigStore(tmp_path / "device_config.sqlite3")
+    client, _ = _client(tmp_path, config_store=config_store)
+
+    response = client.post(
+        "/ui/config/devices",
+        data={
+            "name": "From Form",
+            "driver_type": "wda",
+            "server_url": "http://127.0.0.1:4723",
+            "udid": "form-udid",
+            "wda_local_port": "8100",
+        },
+        follow_redirects=False,
+    )
+    assert response.status_code == 303
+
+    json_devices = client.get("/console/devices").json()
+    assert len(json_devices) == 1
+    assert json_devices[0]["name"] == "From Form"
+    assert json_devices[0]["connection_info"]["udid"] == "form-udid"