[codex] add local Web console

[linjiaye929]

What changed

• add a loopback-only FastAPI/Uvicorn Web console and mini-code-agent web command
• stream replayable Agent lifecycle events over SSE
• pause governed writes and commands for single-use browser approval
• add a responsive three-pane workbench with activity, diff, cancel, and mobile inspector states
• keep Workspace and Provider credentials server-side with CSRF, Origin, CSP, and text-node rendering controls
• add M8 learning and resume documentation
• preserve SYSTEMDRIVE in the minimal Windows command environment to prevent system cache paths from being written relative to test workspaces

Why

M7 exposed the Agent through terminal commands only. M8 makes the same governed runtime observable and controllable in a local browser without duplicating or bypassing the existing Provider, Workspace, Tool, Policy, and approval boundaries.

Validation

• py -3.13 -m uv run pytest --cov -q: 1218 passed, 13 platform/privilege skips, 88.52% coverage
• Ruff format/check: passed
• strict Pyright: passed
• browser checks at 1440x1024, 1024x768, and 390x844: no page overflow; desktop/tablet panes and mobile approval drawer verified
• no live Provider credential used; API and Agent tests use injected runners and mocked transports