Implement M5: hardening, input validation, and Vite+React+TS dashboard

Backend hardening:
- Fix 6 nginx.go non-constant format string build errors
- Add validation.go with hostname, PEM, and enum validators
- Apply input validation to all POST/PUT handlers (certificates,
  agents, CSR, policies, teams, owners, targets, issuers)
- Fix unchecked JSON decode in TriggerDeployment handler

Frontend (Vite + React + TypeScript):
- Migrate from single-file SPA to proper build pipeline
- 7 pages: Dashboard, Certificates (list+detail), Agents, Jobs,
  Notifications, Policies, Audit Trail
- TanStack Query for server state with auto-refetch intervals
- Certificate detail with version history and renewal trigger
- Job cancellation, status/type filtering, expiry countdowns
- Reusable components: DataTable, StatusBadge, ErrorState, PageHeader
- Dark theme with Tailwind CSS, sidebar nav via React Router

Server integration:
- Go server serves web/dist/ (Vite output) with SPA fallback
- Falls back to web/index.html for legacy mode
- .gitignore updated for web/node_modules/ and web/dist/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/src/pages/AgentsPage.tsx

@@ -0,0 +1,64 @@
+import { useQuery } from '@tanstack/react-query';
+import { getAgents } from '../api/client';
+import PageHeader from '../components/PageHeader';
+import DataTable from '../components/DataTable';
+import type { Column } from '../components/DataTable';
+import StatusBadge from '../components/StatusBadge';
+import ErrorState from '../components/ErrorState';
+import { timeAgo } from '../api/utils';
+import type { Agent } from '../api/types';
+
+function heartbeatStatus(lastHeartbeat: string): string {
+  if (!lastHeartbeat) return 'Offline';
+  const ago = Date.now() - new Date(lastHeartbeat).getTime();
+  if (ago < 5 * 60 * 1000) return 'Online';
+  if (ago < 15 * 60 * 1000) return 'Stale';
+  return 'Offline';
+}
+
+export default function AgentsPage() {
+  const { data, isLoading, error, refetch } = useQuery({
+    queryKey: ['agents'],
+    queryFn: () => getAgents(),
+    refetchInterval: 15000,
+  });
+
+  const columns: Column<Agent>[] = [
+    {
+      key: 'name',
+      label: 'Agent',
+      render: (a) => (
+        <div>
+          <div className="font-medium text-slate-200">{a.name}</div>
+          <div className="text-xs text-slate-500">{a.id}</div>
+        </div>
+      ),
+    },
+    {
+      key: 'status',
+      label: 'Health',
+      render: (a) => <StatusBadge status={a.status || heartbeatStatus(a.last_heartbeat)} />,
+    },
+    { key: 'hostname', label: 'Hostname', render: (a) => <span className="text-slate-300 font-mono text-xs">{a.hostname || '—'}</span> },
+    { key: 'ip', label: 'IP Address', render: (a) => <span className="text-slate-400 font-mono text-xs">{a.ip_address || '—'}</span> },
+    { key: 'version', label: 'Version', render: (a) => <span className="text-slate-400 text-xs">{a.version || '—'}</span> },
+    {
+      key: 'heartbeat',
+      label: 'Last Heartbeat',
+      render: (a) => <span className="text-slate-400 text-xs">{timeAgo(a.last_heartbeat)}</span>,
+    },
+  ];
+
+  return (
+    <>
+      <PageHeader title="Agents" subtitle={data ? `${data.total} agents` : undefined} />
+      <div className="flex-1 overflow-y-auto">
+        {error ? (
+          <ErrorState error={error as Error} onRetry={() => refetch()} />
+        ) : (
+          <DataTable columns={columns} data={data?.data || []} isLoading={isLoading} emptyMessage="No agents registered" />
+        )}
+      </div>
+    </>
+  );
+}