feat(maestro): maestro-web standalone binary + reverse-proxy (NAP-241)

New crate crates/maestro-web/: axum server that

* embeds the web/dist SPA bundle via include_dir! (graceful placeholder when
  pnpm build hasn't run yet — keeps fresh checkouts compiling)
* reverse-proxies /api/* HTTP to a co-located daemon (default
  http://127.0.0.1:7070) via reqwest, stripping hop-by-hop headers
* reverse-proxies /api/attach/:id and /api/events WebSockets via
  tokio_tungstenite::connect_async + a tokio task pumping both directions
* reads bind_addr / daemon_url / dev_proxy_target from the new [web]
  config section; env-var overrides MAESTRO_WEB_BIND_ADDR / _DAEMON_URL /
  _DEV_PROXY_TARGET

Integration tests spin up a mock daemon + maestro-web pair on random ports
and verify HTTP forward, SPA fallback, WS echo, and 502 on unreachable
daemon.

Adds a top-level Justfile (`just web` = pnpm install + pnpm build + cargo
build), crates/maestro-web/README.md (config + trust model + dev workflow),
and a docs/INSTALL.md section on optional web UI install.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Justfile

@@ -0,0 +1,29 @@
+# Common dev / build entry points. Run `just` with no args to list.
+
+# Build the maestro-web binary together with the SPA bundle it embeds.
+web:
+    pnpm -C web install --frozen-lockfile
+    pnpm -C web build
+    cargo build -p maestro-web --release
+
+# Run the web bundle in dev mode against a local daemon — Vite serves the
+# frontend with HMR, and `/api/*` is proxied directly to the daemon at
+# 127.0.0.1:7070 (or wherever $MAESTRO_REGISTRY points; see vite.config.ts).
+web-dev:
+    pnpm -C web install
+    pnpm -C web dev
+
+# Typecheck the frontend without building.
+web-typecheck:
+    pnpm -C web install --frozen-lockfile
+    pnpm -C web typecheck
+
+# Full workspace build + tests.
+test:
+    cargo fmt --all -- --check
+    cargo clippy --all-targets -- -D warnings
+    cargo test --all
+
+# Format every Rust source.
+fmt:
+    cargo fmt --all