Add local web mode entrypoint

[Dhirenderchoudhary]

Description

Adds the first slice of local browser-based web mode.

This introduces nanocoder --web and nanocoder --gui, which start a localhost-only web server, generate a private URL token, open the browser, and serve a small token-protected web-mode landing page. The CLI keeps the server alive until shutdown and closes it cleanly on SIGINT / SIGTERM.

Also adds a GUI mode implementation plan documenting the intended phased approach for runtime bridging and future browser chat support.

Phase 1: #628

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Testing

Automated Tests

• New features include passing tests in .spec.ts/tsx files
• All existing tests pass (pnpm test:all completes successfully)
• Tests cover both success and error scenarios

Focused tests run:

pnpm run test:ava source/web/server.spec.ts source/cli.spec.ts

Result: 37 tests passed

Manual Testing

• Tested with Ollama
• Tested with OpenRouter
• Tested with OpenAI-compatible API
• Tested MCP integration (if applicable)
• Manually launched nanocoder --web / nanocoder --gui web shell locally

Checklist

• Code follows project style guidelines
• Self-review completed
• Documentation updated (if needed)
• No breaking changes (or clearly documented)
• Appropriate logging added using structured logging (see CONTRIBUTING.md)

Structured logging is not added because this entrypoint currently prints the local URL directly for CLI usability and does not add background operational logging.

[Dhirenderchoudhary]

@will-lamerton

export function usePrivacyContext() { return useContext(PrivacyContext); }

We have unused exports in our code can i fix it just had to remove it or have to add it in file so that it has to be ignored.

[Dhirenderchoudhary]

@will-lamerton I opened a separate PR for the Semgrep policy findings so those repo-level security/config changes stay out of this phase-1 web mode PR.

For this PR, I only pushed the related unused export fix:

• removed the unused usePrivacyContext export from source/context/privacy-context.tsx
• left the Semgrep workflow/dependency policy changes in the separate PR

This keeps this PR scoped to phase 1 and avoids mixing unrelated CI hardening changes here.

Separate Semgrep PR: #647

[will-lamerton]

Looking great :D