feat: surface task execution progress across Host Agent and Cloud

Host Agent now persists step-level execution detail locally (via a real
TaskMetadataStore/Timeline wired into TaskRunner) and reports a bounded
in-progress snapshot piggybacked on lease renewal. Cloud persists that
snapshot per active assignment and exposes it through the existing task
list/detail query path; Cloud Console renders it as a live badge. Host
Agent's local console gains authenticated, read-only task list and
detail/timeline pages (same-origin, server-rendered) with inlined
screenshots.

Also fixes a pre-existing gap in the shared Timeline: the actual
per-step LLM prompt is now recorded instead of the task goal, benefiting
both Runtime and Host Agent consoles. When a host uses the cloud planner
transport, each decide call's prompt and resulting tool decision are
durably logged in a new planner_decision_log table (with bounded
retention) and browsable from Cloud Console; direct-transport hosts
explicitly surface a "not reported" state.

Includes Alembic migrations 0008 (progress columns on scheduled_tasks)
and 0009 (planner_decision_log), bounded Host-Agent-local retention,
dual-backend repository parity, and Vitest + pytest coverage. Task 6.5
(manual end-to-end device verification) remains.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/cloud-platform/cloud/control_config.py

@@ -38,6 +38,8 @@ class CloudControlConfig:
     trust_proxy_headers: bool = False
     planner_token_reservation_ceiling: int = 4096
     planner_token_reservation_ttl_seconds: int = 300
+    planner_decision_log_prune_interval_seconds: float = 3600.0
+    planner_decision_log_retention_days: int = 7
 
 
 def load_control_config(
@@ -127,6 +129,16 @@ def load_control_config(
             "CLOUD_PLANNER_TOKEN_RESERVATION_TTL_SECONDS",
             300,
         ),
+        planner_decision_log_prune_interval_seconds=_positive_float(
+            values,
+            "CLOUD_PLANNER_DECISION_LOG_PRUNE_INTERVAL_SECONDS",
+            3600.0,
+        ),
+        planner_decision_log_retention_days=_positive_int(
+            values,
+            "CLOUD_PLANNER_DECISION_LOG_RETENTION_DAYS",
+            7,
+        ),
     )
     validate_control_config(config)
     return config
@@ -142,9 +154,7 @@ def validate_control_config(config: CloudControlConfig) -> None:
             "CLOUD_USER_SESSION_ABSOLUTE_SECONDS must be at least the idle TTL"
         )
     if config.environment == "production" and not config.session_cookie_secure:
-        raise CloudConfigurationError(
-            "production requires secure user session cookies"
-        )
+        raise CloudConfigurationError("production requires secure user session cookies")
 
 
 def _positive_float(