web(shell): embedded SvelteKit interface for setup, sign-in, recovery, and status

[TusanHomichi]

Primary Issue

Closes#6

Problem And Outcome

Authentication was API-only; initializing an installation took curl. After merge, a browser pointed at a fresh installation completes the whole Milestone 1 shell — setup, sign-in, status, reset-code issuance, password reset, sign-out — served from the single executable with no Node.js at runtime.

Changes

• web/: SvelteKit 2 + Svelte 5 TypeScript SPA (adapter-static, SSR off): first-run setup wizard, sign-in, password reset, and a status view (agency, user, capabilities, session expiry, database health, version) with manage_users-gated reset-code issuance and sign-out; accessible baseline (labels, alerts, focus styles, light/dark)
• New unauthenticated GET /api/instance ({initialized, version, agency}) drives the client routing guard; authorization stays entirely server-side
• rust-embed embeds web/build (release) or reads it from disk (debug); the router fallback serves assets, hands unknown non-API paths the SPA entry, keeps unknown /api/* as JSON 404s, and sets immutable cache headers for content-hashed files
• A cargo-only build still compiles (build-script placeholder folder) and serves an honest 503 notice + startup warning instead of an interface
• pr-gate now runs npm ci / npm run check / npm run build before the Rust gates, with an npm cache
• ADR 0005: toolchain, embedding, build order, and verification decisions

Scope

• In scope: everything in issue Milestone 1: embedded SvelteKit shell for setup, sign-in, recovery, and status #6
• Out of scope: in-app notices UI (own slice), training-domain UI (Milestone 2+), visual-identity work

Verification

• Listed the exact verification commands run below
• Added or updated tests when behavior changed — 3 new Rust integration tests (asset/fallback/API-404 semantics, instance state) plus a Playwright E2E spec
• Added or updated an ADR when a durable decision changed — ADR 0005
• All fixtures and examples are invented; no real agency data

- (web) npm ci && npm run check (0 errors, 0 warnings)
- (web) npm run build
- cargo fmt --check
- cargo clippy --workspace --all-targets -- -D warnings
- cargo test --workspace (28 passed across 6 targets)
- (web) npx playwright test — full browser lifecycle against the compiled
binary: setup → failed login → sign-in → status → issue reset code →
sign out → reset password → old password refused → new password in →
/setup permanently bounces home (1 passed)

Review And Merge Notes

• Review focus: ADR 0005's build-order/honesty decision (cargo-only builds serve a 503 notice rather than failing to compile), and the fallback handler's API/SPA split in web_assets.rs
• User or operator impact: operators get a real interface; contributors touching web/ need Node.js at build time only