Add a browser operator console to the durable-agent demo

[7nohe]

examples/agents demonstrates the RFC 0017 durable agent runtime, but it was
API-only: the approval loop could only be driven with curl and a bearer token.
It now also serves an Inertia console that shows the tickets, the pending
approvals and the agent's own report on one page, with Approve, Reject and
Run sweep.

The JSON surface is unchanged

Routes carrying .agent() metadata keep returning JSON — guren check warns
about an agent route answering with an Inertia response, because a rendered page
is not a tool result. tool:list output is byte-identical to main.

The console gets its own actions under /console/*, so the bare /approvals/...
paths the README's curl walkthrough uses keep working. Both surfaces answer
approvals through one shared module (app/Services/approvals.ts): a second copy
of "which rows are answerable" is the copy that hands the agent a grant a human
gave once. Only presentation differs — the console redirects and flashes the
refusal, the API returns a status code.

Login and sessions

Login spends the same bearer token the API takes, verified with verifyApiToken.
users carries no password column, and scrypt in a request path does not fit the
Workers Free CPU budget (10 ms per invocation against a measured 20-31 ms cold
boot). SessionGuard.login() rotates the session id, so a pre-auth session
cannot be fixated.

Sessions use DatabaseSessionStore over a new sessions table: on Workers the
login redirect and the page it lands on are answered by different isolates, so
per-isolate memory would drop the session.

cookieSecure cannot be decided by NODE_ENV here — wrangler.jsonc defines it
to "production" at bundle time, local or not. The app reads its own
TRIAGER_INSECURE_COOKIES, through getters, because wrangler vars land after
the module evaluates.

Route wiring and the CLI flags

routes/web.ts is now the app's single entry registrar and calls
registerApiRoutes(router), which is what lets guren check reach routes/api.ts
from the entry createApp({ routes }) names. Consequently:

• audit dropped its --routes routes/api.ts flag and now covers 31 checks
  instead of 23 — the console's six new routes are the new attack surface.
• codegen was repointed to routes/web.ts; it needs the whole graph.
• check and tool:list carried no flag and still need none.

CSRF

No configuration was needed in either direction. createApp({ auth }) mounts CSRF
over the whole app; the console carries a session cookie and is verified, while a
bearer request that carries no cookies is exempt on its own terms, as is a request
carrying the agent principal the pipeline installed. The one visible change: a
mutating request with neither a bearer header nor a CSRF token now answers 403
rather than 401, because CSRF runs ahead of the auth middleware.

Free-plan budget

One console render costs 6 D1 queries (7 when the session is written back rather
than touched), against the 50-per-invocation Free-plan ceiling. Ticket and
approval listings are bounded at 40 / 50 / 20 rows.

Also fixed

resolveApproval derived its refusal status without the pending-only guard that
presentApproval has, so an approval that was answered and then passed its window
was refused as "expired before it was answered". Both now share one statusAt().
The HTTP status was, and stays, 409.

Scope

examples/agents/** and docs/** only — nothing under packages/, so no
changeset and nothing to release.

Verification

• Root: build, typecheck, lint, audit:core-first, audit:docs — all green.
• examples/agents: test 27 pass, check 15 passed / 6 warnings / 0 failures,
  audit 31 passed / 1 pre-existing advisory warning / 0 failures.
• wrangler dev --local, full loop: sign in, Run sweep, two approvals appear,
  Approve one and Reject the other, wait past the ledger's first backoff without
  sweeping, then the approved ticket closes by alarm and the rejected one appears
  under declined. examples/agents/console.png is that state.
• bun run dev: sign in and console render re-confirmed after the final
  simplification pass, which was separately checked to leave the rendered markup
  unchanged across populated, empty and no-sweep prop shapes.