feat(webui): read-only Queue, Business and Settings views (#1543, row 54)

The Console gains three read-only views. Queue lists every row from
rows() in packages/queue (lead decision 83: the same lock-free read as
`queue list`, writing nothing), run in a child with a timeout and an
output cap; a row page shows the full row. Business shows names, an
allowlist of vars, arbiters, authority per action and credential
metadata (service, account, role, date, never a value, file or
variable). Settings shows RELEASE, the board origin and the notifier
binding. Every route is GET only, and every string in a body or
refusal passes a redactor: the config directory and dataRoot become
<config> and <dataRoot>, other absolute, ~/ and file:// paths <path>,
and 17 to 20 digit runs <id>. A queue-read that fails to start sends a
fixed message, never node's stderr.

Four fixes to HEAD behaviour, each with a test: the bus view's refresh
timer is cleared at render, a same-page refresh keeps focus on the H1,
#conv-pick is emptied when a conversation opens, and error() returns
focus to <main> only when something had focus. Filbert's T8 tests the
failed first read.

Dewey built it in two rounds. Round 1 (dba2429e) got changes from
Filbert (27185: After rendered [object Object], ~/ and :/ paths leaked)
and Darkwing (27186: Arbiters always none, queue-read import failure
leaked a file:// path and stack). Round 2 (afb2ae0e) was approved by
Filbert (27190) and Darkwing (27191, correction 27192). Sage's gate on
d64f434f plus the candidate: 13 package node suites 0 failed (queue
149, webui 39), every scripts/test-*.sh 0 failed (task 98/0 with
Docker, 26/0 without; release 14/0), build-tokens --check current.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

agents/dewey/work/queue-54/candidate-manifest.sha256

@@ -0,0 +1,14 @@
+3db6ee2a4d4b05de6768709da0c21c6815c0d7899fb9389d659444828264275d  packages/queue/README.md
+352d96c5cc02d01e5d524c1a9106985c0f0a12b7312d7de157d9bf733dead4d5  packages/queue/src/store.mjs
+b44f6f8b07cad4f35dfc92bee2c762845052b2b79f990f7cd5f590efd2b05544  packages/queue/tests/write.test.mjs
+c6880e55f5590b9801066e56b9cf3b76be633b60df4141a83d7701dc3d45af73  packages/webui/README.md
+07d2c06523dd89f82c9ea14757852b16434f7207df57d7dfcbc58425e6e75c1d  packages/webui/src/cli.mjs
+5a611e2339fa9e31c489d24460f82852ca2bc892f07265ffdc5eca03b579541b  packages/webui/src/public/app.js
+a640185c5ca1458135e2297d1fb1059c893a1269b0ff20cfb3044ce297588df2  packages/webui/src/public/bus.js
+4f65ab7f6a446b0ffd3c666b1ac1a726fbd5de0814a43b19f566a844e40163b0  packages/webui/src/queue-read.mjs
+95767269e5971d66acea98271a028ee6ebc1540dd17849a23bdaaa7ba29b42e8  packages/webui/src/reads.mjs
+8121915343ad5000cf66d474d9e4a994ce6c44ff1977822a067ad5ffd2fbbf29  packages/webui/src/serve.mjs
+9221692892ac56d7097128bd88dd34b76dc39861a3ff3996eb9eae999751775b  packages/webui/tests/reads-fixture.mjs
+47a9931cdabfa2e164bd62e5f5ca51fbf05273211e539ef42659926274f946d9  packages/webui/tests/reads.test.mjs
+85f3bd247e6f99da717a51d71db13b65d511fffa8f0232ecbafa6c5000430c4e  packages/webui/tests/shell.test.mjs
+35f437bcafc5ae6bc698581a0d722f6154b092cc633973e492aede0ea29eb8f4  packages/webui/tests/views.test.mjs