feat(ui): TDS migration stage 1 — EJS layout, CSP, vendored design system, shared runtime

- Vendor web_template base.css/base.js (v1.2 bbec859) under public/web_template with sync script
- Add views/layout.ejs (fixed upstream EJS comment delimiters, mobile drawer, cmd palette,
  keys help, WS status, theme toggle) and lib/render.js two-step renderer
- Add page routes for /, /workers, /workflows, /executions, /quick, /scheduler (stub views)
- helmet with strict nonce CSP (script-src-attr 'none'), /csp-report, report-only toggle
- lib/pageauth.js: shared users upsert + HTML 401/403 for page routes
- PULSE_DEV_READONLY guard disabling background writers for local testing
- public/assets/app.js shared runtime (Pulse namespace, delegated actions, WS singleton,
  themed confirm modal) and app.css
- eslint globals for browser files; ignore vendored assets

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HamVMDrA8RqhyxmUHgiqRp

scripts/sync-web-template.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Vendor base.css / base.js from a LotusGuild web_template checkout into public/web_template/.
+#
+# Usage: scripts/sync-web-template.sh <path-to-web_template-checkout>
+#
+# Writes public/web_template/{base.css,base.js} as regular files (never symlinks) and
+# public/web_template/VERSION containing "v1.2 <short-sha> <iso-date>".
+set -euo pipefail
+
+SRC="${1:-}"
+if [ -z "$SRC" ]; then
+  echo "usage: $0 <path-to-web_template-checkout>" >&2
+  exit 2
+fi
+if [ ! -d "$SRC" ]; then
+  echo "error: source directory not found: $SRC" >&2
+  exit 2
+fi
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DEST="$REPO_ROOT/public/web_template"
+mkdir -p "$DEST"
+
+for f in base.css base.js; do
+  if [ ! -f "$SRC/$f" ]; then
+    echo "error: missing $SRC/$f" >&2
+    exit 1
+  fi
+  rm -f "$DEST/$f"
+  cp "$SRC/$f" "$DEST/$f"
+  chmod 644 "$DEST/$f"
+  echo "synced $f"
+done
+
+SHA="$(git -C "$SRC" rev-parse --short HEAD 2>/dev/null || echo unknown)"
+DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+printf 'v1.2 %s %s\n' "$SHA" "$DATE" > "$DEST/VERSION"
+echo "VERSION: $(cat "$DEST/VERSION")"