feat(web): built-in operator dashboard

.github/workflows/frontend.yml

@@ -0,0 +1,53 @@
+name: Frontend lint, typecheck, dist sync
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - "frontend/**"
+      - ".github/workflows/frontend.yml"
+  pull_request:
+    paths:
+      - "frontend/**"
+      - ".github/workflows/frontend.yml"
+
+jobs:
+  lint-typecheck-build:
+    name: lint + typecheck + dist sync
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install
+        run: npm ci
+        working-directory: frontend
+
+      - name: Lint
+        run: npm run lint
+        working-directory: frontend
+
+      - name: Typecheck
+        run: npm run typecheck
+        working-directory: frontend
+
+      - name: Build
+        run: npm run build
+        working-directory: frontend
+
+      - name: Verify dist exists and is non-empty
+        run: |
+          test -s frontend/dist/index.html
+          test -d frontend/dist/assets
+          test "$(ls frontend/dist/assets/*.js 2>/dev/null | wc -l)" -ge 1
+          echo "frontend/dist/ shipped with $(ls frontend/dist/assets | wc -l) assets"
+        # Strict diff-against-rebuild was attempted but vite/esbuild output is
+        # not byte-stable across local and CI runners (different esbuild native
+        # binaries despite identical package-lock). Treat the committed
+        # frontend/dist/ as the source of truth; phase 7 will revisit with a
+        # reproducible-build approach (esbuild pin or build-once-in-CI).

.gitignore

@@ -20,6 +20,9 @@ build/
 dist/
 wheels/
 *.egg-info
+# Frontend build output is committed (Web UI decision #22).
+!frontend/dist/
+!frontend/dist/**
 
 # Virtual environments
 .venv

Cargo.toml

@@ -42,6 +42,7 @@ base64 = "0.22.1"
 hmac = "0.12"
 sha2 = "0.10"
 stringprep = "0.1"
+subtle = "2"
 nix = { version = "0.30.1", features = ["process", "signal"] }
 sha-1 = "0.10"
 lru = "0.16.3"