feat(server): add read-only web dashboard behind OPENSHELL_WEB_UI gate

Add a web_ui module to openshell-server that serves a single-file SPA
at /ui plus a small JSON/SSE API under /ui/api/*:

- overview, sandbox list, and sandbox detail (policy revision history
  and current policy YAML) adapted from existing gRPC handler logic
- initial log tail and a live SSE stream bridged from TracingLogBus,
  so network policy decisions (allow/deny with full reason) appear in
  the browser in real time
- the entire surface only mounts when OPENSHELL_WEB_UI=1 is set; the
  routes bypass gRPC bearer auth and are intended for trusted
  local/dev gateways until proper authn/z lands

The frontend is a dependency-free embedded HTML file: sandbox rail
with phase indicators and j/k navigation, a live decision board that
renders OCSF allow/deny events as strips, a filterable following log
tail, and a policy pane with YAML and revision status.

Widen five gRPC handler fns to pub (and grpc::sandbox to pub) so the
web adapter can reuse them in-process instead of duplicating data
access.

Refs #2192

Signed-off-by: rose young <samediyam@gmail.com>

Author: evanjang