feat(maestro): add just dev full-stack recipe and fix dev attach proxy

`just dev` builds maestro and runs the whole local stack in one command
— registry (:8080), daemon (:7070), and the Vite web UI (:5173) — waits
for each to be healthy, and tears all three down on Ctrl-C. Previously
the Justfile only had frontend/CI recipes; running the project meant
hand-starting the registry and daemon in separate terminals.

Also fix attach under the Vite dev server: `/api/attach/:id` is a
daemon-served broker WebSocket (NAP-243), not a registry route, so the
old catch-all `/api` proxy sent it to the registry and got 404. Route
`/api/attach` to the daemon (overridable via MAESTRO_DAEMON) and keep
everything else on the registry — the same split the production
maestro-web binary does. Verified: handshake now returns 101 and PTY
bytes stream.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Justfile

@@ -1,5 +1,42 @@
 # Common dev / build entry points. Run `just` with no args to list.
 
+# The registry (:8080) is the phone book, the daemon (:7070) runs the tmux
+# sessions, and Vite serves the UI at http://localhost:5173 (attach is proxied
+# to the daemon; see web/vite.config.ts). Override the secret with MAESTRO_TOKEN.
+# Run the full local stack — registry + daemon + web UI; Ctrl-C stops all three.
+dev:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    token="${MAESTRO_TOKEN:-devtoken}"
+    bin="target/debug/maestro"
+
+    echo "▶ building maestro…"
+    cargo build --bin maestro
+
+    pids=()
+    cleanup() { echo; echo "▶ stopping stack…"; for p in "${pids[@]:-}"; do kill "$p" 2>/dev/null || true; done; }
+    trap cleanup EXIT INT TERM
+
+    echo "▶ registry → http://127.0.0.1:8080"
+    MAESTRO_TOKEN="$token" MAESTRO_REGISTRY_BIND_ADDR=127.0.0.1:8080 "$bin" registry &
+    pids+=($!)
+    # Wait for the registry to accept connections before starting the daemon.
+    for _ in $(seq 1 50); do (exec 3<>/dev/tcp/127.0.0.1/8080) 2>/dev/null && break || sleep 0.2; done
+
+    echo "▶ daemon   → ws://127.0.0.1:7070 (id: $(hostname))"
+    MAESTRO_TOKEN="$token" \
+    MAESTRO_REGISTRY_URL=http://127.0.0.1:8080 \
+    MAESTRO_DAEMON_BIND_ADDR=127.0.0.1:7070 \
+    MAESTRO_DAEMON_URL=ws://127.0.0.1:7070 \
+        "$bin" daemon run &
+    pids+=($!)
+    for _ in $(seq 1 50); do (exec 3<>/dev/tcp/127.0.0.1/7070) 2>/dev/null && break || sleep 0.2; done
+
+    echo "▶ web UI   → http://localhost:5173  (Ctrl-C to stop everything)"
+    pnpm -C web install
+    MAESTRO_REGISTRY=http://127.0.0.1:8080 MAESTRO_DAEMON=http://127.0.0.1:7070 \
+        pnpm -C web dev
+
 # Build the maestro-web binary together with the SPA bundle it embeds.
 web:
     pnpm -C web install --frozen-lockfile

web/vite.config.ts

@@ -19,6 +19,14 @@ export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd(), "");
   const target = resolveProxyTarget(env.MAESTRO_REGISTRY);
   const secure = target.startsWith("https://");
+  // `/api/attach/:id` is a DAEMON-served broker WebSocket (NAP-243), not a
+  // registry route — the registry returns 404 for it. In production the
+  // `maestro-web` binary splits this traffic; in dev we replicate that here by
+  // forwarding `/api/attach` straight to the local daemon. Override with
+  // MAESTRO_DAEMON; defaults to the standard local daemon bind.
+  const daemonTarget = env.MAESTRO_DAEMON
+    ? resolveProxyTarget(env.MAESTRO_DAEMON)
+    : "http://127.0.0.1:7070";
   return {
     build: {
       target: "es2022",
@@ -28,7 +36,15 @@ export default defineConfig(({ mode }) => {
     },
     server: {
       port: 5173,
+      // NOTE: order matters — Vite uses the first matching key, so the more
+      // specific `/api/attach` must come before the catch-all `/api`.
       proxy: {
+        "/api/attach": {
+          target: daemonTarget,
+          changeOrigin: false,
+          ws: true,
+          secure: false,
+        },
         "/api": {
           target,
           changeOrigin: secure,