build: embedded web UI (trace surface + parity)

[aksOps]

Tracking issue for the embedded web UI build. Design and contracts are settled: map #51, paradigm #55, build chain #54, data contract #56, rollup #59, read-only store #60, capability identity #61. Prototype: rev 4.1 trace surface.

Milestones:

• M1 store layer: hourly rollup (UTC keys, collector-tx maintenance, rebuild), store.OpenReadOnly, UsageEvent.ID, explicit column projection (raw excluded by default). Closes store: add a read-only open for consumers that must never write #60.
• M2 internal/web: /api/summary /api/facets /api/events /api/meta /api/ws, embed via webui build tag + stub, serve command (loopback 37800, read-only store, no daemon auto-spawn, never the collection lock), capability in buildinfo.Identity().
• M3 webui app: Vite/React/TS scaffold, trace scene port with mouse+touch interaction, TanStack Query, charts seam, mock-to-real data adapter.
• M4 release wiring: npm build on release tag before GoReleaser, -tags webui, CI gates run twice (with and without the tag), .gitignore for dist.
• M5 parity overlays: input/output/cache series split in scene + readout, leverage pivot, by-model/by-project facets, ranked drill table (sort/filter), KPI deltas/sparklines/shares, freshness chip states + stall banner, cost partial markers, help overlay, empty/error vocabulary (zero tokens / no rows / query failed), range preset chips.
• M6 live wiring: WS watermark push from db/-wal mtime observation, contract-version self-reload, follow-live against real collection cycles.

Hard constraint carried from #56: no endpoint returns raw, ever (no auth in front of the public hostnames; 45,615 legacy rows hold whole transcript lines).

[aksOps]

M1-M4 landed on main as 6d41eaa (store), 34e74ea (web package), b57b71b (frontend), bd7caab (CI/release), after two orchestrated rounds: build (6 agents) and fix (3 agents), each ending in an adversarial verification pass against a copy of the real 361k-row ledger.

Notable deltas against the original plan, all verified:

• The rollup is keyed by 15-minute UTC buckets, not hours, and the table is named usage_rollup: hour keys fold wrong in half-hour zones (Asia/Kolkata loses the first 30 minutes of every local day). Equivalence under TZ=Asia/Kolkata: day 53/53 keys, hour 539/539, zero mismatches; rebuild 0.5-1.0s for 2,882 rows; bucketed reads 300-500x faster than ledger scans.
• A stale or empty rollup (fresh migration, daemonless box) falls back to the ledger; every aggregate response carries "source": "rollup"|"ledger".
• Host allowlist (default loopback, --allowed-hosts for proxied names) answering 421 otherwise, and the WS origin check uses the same list - closes the DNS-rebinding read of the ledger. The embedded page carries a strict same-origin CSP.
• Production bundles default to the live API and lazy-load the mock chunk; the first build round shipped mock-wired dashboards, caught by verification against the built artifact.
• vite 8.0.16 (two Windows-only advisories in 8.0.9); npm audit clean.

Remaining: M5 parity overlays, M6 live wiring polish. Known wire warts, deliberate: totals.sessions is 0 on rollup-served answers (documented; no consumer), facet ranges snap outward to whole 15-minute buckets on the rollup path.