## Why

The local Runtime console is currently a separately built Vue/Vite SPA. It
requires a Node toolchain for development and an optional static-directory
configuration for same-process serving, even though its data and mutations
already live in the Runtime FastAPI process. Rendering the console with Jinja2
will make the operator surface deploy with the Runtime itself while preserving
the existing REST contract for programmatic clients.

## What Changes

- Add a same-origin, server-rendered Runtime console under `/ui/`, with Jinja2
  pages for device status, task browsing/detail/timeline replay, device
  registration/removal, and runtime configuration.
- Keep the existing `/console/*` JSON endpoints and make page handlers and
  JSON handlers share API-layer console operations so their observable
  registration, deletion, filtering, and configuration semantics cannot
  drift.
- Package console templates and static assets with `device-agent-runtime`, add
  direct Jinja2 and HTML form-parsing dependencies, and render every HTML page
  through one autoescaping template environment.
- Replace the Vue/Vite `console/` project, `RUNTIME_CONSOLE_STATIC_DIR`, and
  SPA fallback static mount with Runtime-owned templates and normal static
  assets. Remove the permissive CORS configuration that existed only for
  cross-origin Vite development.
- **BREAKING**: the independent `console/` npm workflow and
  `RUNTIME_CONSOLE_STATIC_DIR` deployment mode are removed. Operators will
  start the Runtime API normally and open `/ui/`; JSON API paths remain
  unchanged.

## Capabilities

### New Capabilities

- `runtime-console-template-rendering`: Same-origin Jinja2-rendered Runtime
  console pages, automatic HTML escaping, form-based mutations, and packaged
  Runtime-owned web assets.

### Modified Capabilities

- None. The existing canonical specs do not define the pending `web-console`
  SPA, and the `/console/*` JSON API contract remains unchanged.

## Impact

- Affected code: `api/rest.py`, `api/console.py`, a new API-layer page router,
  Runtime template/static asset directories, root `pyproject.toml`, and
  console-focused tests.
- Removed code/assets: top-level `console/` Vue/Vite sources, Node lockfile,
  Vite environment configuration, and SPA deployment wiring.
- Documentation: Runtime startup and console guidance in `README.md`,
  `docs/CONSTITUTION.md`, and `docs/MACOS_IPHONE_SETUP.md` change to describe
  the built-in `/ui/` console.
- Security boundary: this change preserves the existing trusted-network,
  unauthenticated Runtime console assumption. It does not add authentication,
  authorization, or session/CSRF protection; non-trusted exposure needs a
  separate security change.
- Architecture: all new HTTP, HTML, and template concerns remain in the outer
  `api` layer. No `core`, `driver`, `device`, `tools`, `perception`, or
  `runtime` package gains web-framework dependencies.