feat(ui): TDS migration stage 1 — EJS layout, CSP, vendored design system, shared runtime

- Vendor web_template base.css/base.js (v1.2 bbec859) under public/web_template with sync script
- Add views/layout.ejs (fixed upstream EJS comment delimiters, mobile drawer, cmd palette,
  keys help, WS status, theme toggle) and lib/render.js two-step renderer
- Add page routes for /, /workers, /workflows, /executions, /quick, /scheduler (stub views)
- helmet with strict nonce CSP (script-src-attr 'none'), /csp-report, report-only toggle
- lib/pageauth.js: shared users upsert + HTML 401/403 for page routes
- PULSE_DEV_READONLY guard disabling background writers for local testing
- public/assets/app.js shared runtime (Pulse namespace, delegated actions, WS singleton,
  themed confirm modal) and app.css
- eslint globals for browser files; ignore vendored assets

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HamVMDrA8RqhyxmUHgiqRp

public/.eslintrc.json

@@ -1,6 +1,13 @@
 {
     "env": { "browser": true, "es2021": true },
     "parserOptions": { "ecmaVersion": 2021, "sourceType": "script" },
+    "globals": {
+        "lt": "readonly",
+        "Pulse": "writable",
+        "CSRF_TOKEN": "readonly",
+        "CURRENT_USER": "readonly",
+        "PULSE_CONFIG": "readonly"
+    },
     "rules": {
         "no-unused-vars": "warn",
         "no-empty": "warn",