feat(staged): add browser-accessible web mode - #709

Restore the full Axum HTTPS web server (previously stubbed) and implement
the frontend transport layer for running Staged in a browser. This enables
phone and desktop browser access to a running Staged instance.
Key changes:
- Unstub web_server::start() with TLS listener, static file serving, and
 auth-protected API routes
- Add HTTP transport in invokeCommand() that POSTs to /api/invoke/{command}
 with automatic 401 redirect to login
- Add WebSocket singleton for server-sent events in web mode
- Add WebLogin.svelte token entry screen with /api/auth session cookie flow
- Implement localStorage backend for persistentStore in web mode
- Expose web access token via Tauri command and settings UI with copy button
- Add `just dev-web` recipe requiring HTTPS cert/key env vars
- Add writeClipboardText/readClipboardText web fallbacks in transport layer
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>

Signed-off-by: Matt Toohey <contact@matttoohey.com>

Unauthenticated HTTPS is enough for browser access, so drop the bearer
token / session cookie layer entirely:
- Remove the require_auth middleware, /api/auth endpoint, session
 registry, and token generation from the Axum web server
- Remove the WebAccessToken managed state and get_web_access_token
 Tauri command
- Remove the WebLogin token entry screen, #/login hash routing, and
 401-redirect handling from the frontend transport layer
- Remove the token display/copy section from the settings page
- Drop the now-unused axum-extra, rand, hex, subtle, and time crates
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>

Encode the "release build + web server" flow from the note so its two traps
aren't rediscovered each time:
- Guard on STAGED_WEB_CERT_PATH/STAGED_WEB_KEY_PATH before building, using
 the same error style as `dev-web` (STAGED_WEB_HOST isn't needed here)
- Build with `tauri build --bundles app`, which regenerates dist/ and skips
 the DMG, keeping the window's embedded assets and the server's on-disk
 dist/ in sync
- Resolve the bundle under CARGO_TARGET_DIR and launch from src-tauri, since
 only the cwd-relative `../dist` candidate resolves for a release binary
- Probe https://localhost:5175/sw.js after launch and report cert/port versus
 missing-dist failures, which release builds otherwise swallow (no logger)
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>