feat(web-tui): add experimental browser-hosted TUI

[akonwi]

Summary

• add an opt-in kit --web-tui mode that hosts the real OpenTUI app in a desktop browser through ghostty-web
• keep one authoritative Kit runtime with custom terminal streams, authenticated WebSocket transport, reconnect repaint, browser input normalization, and exact custom-theme rendering
• route browser-owned clipboard, notification, bell, link, and startup-model behavior without invoking remote host terminal integrations
• share the semantic web access policy for Host/Origin checks, optional Basic Auth, canonical --public-url, and restrictive CSP
• add compiled-binary Playwright coverage and gate pull requests, main, and releases on Chromium, Firefox, and WebKit

Safety and scope

• remains opt-in; normal kit --web continues to serve the semantic SPA
• defaults to loopback and does not trust forwarded headers
• desktop macOS/Linux scope; semantic web remains the mobile, upload, and accessible interface
• one active browser client; a newer initialized client replaces the previous one
• pinned to [email protected]

Validation

• bun run typecheck
• bun run check
• bun test — 742 passing
• source and compiled script/smoke-web-tui.ts
• Playwright — 18 passing across Chromium, Firefox, and WebKit

Documentation

See docs/experiments/web-tui-ghostty-web.md for architecture, hosting boundaries, compatibility decisions, footprint, and remaining limitations.