[codex] ship full WebUI console and release hardening

[ymxc152]

Summary

• add the complete FastAPI + React administration console, persistent worker, automation services, and Windows deployment templates
• harden file execution, path safety, immutable plan workflows, review/rule management, and rollback recovery
• renew worker leases during long handlers and restrict first-run administrator bootstrap to the server loopback interface
• document supported Python/Node/pnpm versions and LAN HTTPS deployment

Release fixes

• records failed_partial_rollback with operation log, applied items, compensation results, and rollback errors
• adds periodic worker heartbeats without changing crashed file-operation interruption semantics
• rejects remote /api/v1/auth/bootstrap requests in both the API and example Caddy deployment
• uses react-router-dom 6.30.4 and enforces a high/critical production audit gate

Validation

• Python suite: 155 tests exercised; the only failures were legacy TestClient addresses, then all 5 affected tests passed after explicitly using loopback (1 Windows symlink-privilege skip)
• targeted release-blocker tests: 34 passed
• Vitest: 12 passed
• Vite production build passed
• Playwright console E2E: 4 passed; optional real-file suite skip as designed
• isolated link/copy/move real-file E2E passed
• pip check, compileall, frozen pnpm install, and git diff --check passed
• production audit has no high or critical advisories