Implement M5: hardening, input validation, and Vite+React+TS dashboard

Backend hardening:
- Fix 6 nginx.go non-constant format string build errors
- Add validation.go with hostname, PEM, and enum validators
- Apply input validation to all POST/PUT handlers (certificates,
  agents, CSR, policies, teams, owners, targets, issuers)
- Fix unchecked JSON decode in TriggerDeployment handler

Frontend (Vite + React + TypeScript):
- Migrate from single-file SPA to proper build pipeline
- 7 pages: Dashboard, Certificates (list+detail), Agents, Jobs,
  Notifications, Policies, Audit Trail
- TanStack Query for server state with auto-refetch intervals
- Certificate detail with version history and renewal trigger
- Job cancellation, status/type filtering, expiry countdowns
- Reusable components: DataTable, StatusBadge, ErrorState, PageHeader
- Dark theme with Tailwind CSS, sidebar nav via React Router

Server integration:
- Go server serves web/dist/ (Vite output) with SPA fallback
- Falls back to web/index.html for legacy mode
- .gitignore updated for web/node_modules/ and web/dist/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmd/server/main.go

@@ -174,10 +174,15 @@ func main() {
 		middleware.Recovery,
 	)
 
-	// Wrap with dashboard static file serving if web/ directory exists
+	// Wrap with dashboard static file serving
+	// Vite builds to web/dist/; fall back to web/ for legacy single-file SPA
 	var finalHandler http.Handler
-	webDir := "./web"
-	if _, err := os.Stat(webDir); err == nil {
+	webDir := "./web/dist"
+	if _, err := os.Stat(webDir + "/index.html"); err != nil {
+		webDir = "./web"
+	}
+	if _, err := os.Stat(webDir + "/index.html"); err == nil {
+		fileServer := http.FileServer(http.Dir(webDir))
 		finalHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			path := r.URL.Path
 			// API and health routes go to the API handler
@@ -186,10 +191,15 @@ func main() {
 				apiHandler.ServeHTTP(w, r)
 				return
 			}
-			// Serve the dashboard SPA index.html for everything else
+			// Try to serve static files (JS, CSS, assets)
+			if len(path) > 8 && path[:8] == "/assets/" {
+				fileServer.ServeHTTP(w, r)
+				return
+			}
+			// SPA fallback: serve index.html for all other routes
 			http.ServeFile(w, r, webDir+"/index.html")
 		})
-		logger.Info("dashboard available at /")
+		logger.Info("dashboard available at /", "web_dir", webDir)
 	} else {
 		finalHandler = apiHandler
 		logger.Info("dashboard directory not found, serving API only")