Add read-only web status spike

[tongtinghei88]

Summary

Adds an isolated minimal browser-only Vite React read-only status app under:

packages/web-readonly-status

This is the Spike 3P web readonly status milestone. It is intentionally separate from the existing full packages/web runtime.

Scope

This PR only adds/changes files under:

packages/web-readonly-status

No changes are included under:

• packages/mobile/*
• packages/web/server/*
• packages/web/src/api/*
• backend repo files
• adapter server code

Read-only boundary

The app only performs one approved browser request:

GET http://192.168.50.202:8790/api/local/v0/summary

The request uses:

• method: "GET"
• credentials: "omit"

The app keeps defensive URL validation and does not add:

• direct executable 4096 access
• POST / PUT / PATCH / DELETE
• auth headers / cookies / bearer tokens / provider keys
• localStorage / sessionStorage
• WebSocket / EventSource / SSE / polling
• chat / agent / terminal / git / provider / filesystem UI
• server code

UI verification

Final expected labels:

• Browser/page title: OpenCode Read-Only Status
• Visible main title: OpenCode Read-Only Status
• Visible safety label: Read-only local adapter view

Validation

Completed and passed:

• UI label fix diff review
• production build + preview browser sanity
• final review gate
• clean sync branch verification
• fork branch push verification

Production browser sanity confirmed:

• page loads from production build / preview
• manual refresh works
• adapter available behavior passes
• adapter unavailable fail-closed behavior passes
• no direct browser request to 4096
• no POST / PUT / PATCH / DELETE
• no WebSocket / EventSource / SSE / polling / HMR
• no Vite dev-server artifacts such as @vite/client, React Refresh, or HMR WebSocket

Notes

This PR is submitted from a clean fork branch because the original upstream repo did not grant direct write access to tongtinghei88.