feat(client): add Sentinel rule administration

[enkerewpo]

What changed

• add an administrator-only Sentinel page for listing, editing, validating, and replacing robot-level rules
• expose generic typed conditions for subjects, capability calls, time windows, arguments, and robot context; no robot-specific predicate is hard-coded
• discover the robot-local sentinel provider through Atlas and authenticate management calls with the current Keystone session
• hide Sentinel navigation from non-admin users and keep server-side admin enforcement authoritative
• check in the Sentinel source proto, pin the code-generation tool, and provide byte-reproducible Python binding generation

Why

This is the minimum Client surface for the Keystone/Sentinel demo: robot administrators can manage policy while ordinary users cannot see or call the management surface.

Backend dependency

• feat(sentinel): add authenticated robot policy enforcement robonix#205
• this PR intentionally targets feat/keystone-accounts, matching the authenticated account/session API it consumes

Validation

• PYTHONPATH=src python -m unittest discover -s tests -v (28/28)
• PYTHONPATH=src mypy --ignore-missing-imports src/robonix_client/app.py src/robonix_client/transport.py
• Python compileall
• node --check src/robonix_client/static/app.js
• bash -n scripts/generate_sentinel_proto.sh
• regenerated sentinel_pb2.py is byte-identical, SHA-256 e1c1541c83dd2c214f4b0520ea4cb731a46b3a06cc6256413b82433bdb13b0cc
• built wheel contains both sentinel.proto and sentinel_pb2.py
• git diff --check

Black is not configured or enforced by this branch; existing modified Python formatting was left unchanged to avoid an unrelated rewrite.