Add control board web page and local server (#1503)

Step 2 of the control board MVP (MOSAIC-STACK-D-001): `serve` command starts
a loopback-only local server that serves one self-contained page and re-runs
the status scanner on each /api/board request. The page lists sessions
waiting on Jason first (errors on top), then one table per project with
plain-word states, ages, last messages, expandable detail rows, per-project
hide-offline, and a 10-second auto-refresh with pause.

Tests: control-board 33/33 (10 new: loopback rules, host refusal, all routes,
per-request rescan, 500 path, CLI refusals, live serve, page escaping guard);
registry 69/69 unchanged. Receipt:
docs/plans/reviews/2026-09-12_control-board-step2-review.md.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

docs/plans/2026-09-12_control-board-mvp.md

@@ -83,12 +83,20 @@ Board files are derived. They can be deleted and rebuilt at any time by
 running the scanner again. They are NOT run records and they are not
 evidence under the repository's write-once rules.
 
-## Command
+## Commands
+
+Scan once and print the table:
 
 ```
 node packages/control-board/src/cli.mjs scan --print
 ```
 
+Start the page (step 2), then open http://127.0.0.1:7331/ in a browser:
+
+```
+node packages/control-board/src/cli.mjs serve
+```
+
 Tests:
 
 ```