Implement M5: hardening, input validation, and Vite+React+TS dashboard

Backend hardening:
- Fix 6 nginx.go non-constant format string build errors
- Add validation.go with hostname, PEM, and enum validators
- Apply input validation to all POST/PUT handlers (certificates,
  agents, CSR, policies, teams, owners, targets, issuers)
- Fix unchecked JSON decode in TriggerDeployment handler

Frontend (Vite + React + TypeScript):
- Migrate from single-file SPA to proper build pipeline
- 7 pages: Dashboard, Certificates (list+detail), Agents, Jobs,
  Notifications, Policies, Audit Trail
- TanStack Query for server state with auto-refetch intervals
- Certificate detail with version history and renewal trigger
- Job cancellation, status/type filtering, expiry countdowns
- Reusable components: DataTable, StatusBadge, ErrorState, PageHeader
- Dark theme with Tailwind CSS, sidebar nav via React Router

Server integration:
- Go server serves web/dist/ (Vite output) with SPA fallback
- Falls back to web/index.html for legacy mode
- .gitignore updated for web/node_modules/ and web/dist/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/src/api/client.ts

@@ -0,0 +1,90 @@
+import type { Certificate, CertificateVersion, Agent, Job, Notification, AuditEvent, PolicyRule, Issuer, Target, PaginatedResponse } from './types';
+
+const BASE = '/api/v1';
+
+async function fetchJSON<T>(url: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(url, {
+    headers: { 'Content-Type': 'application/json', ...init?.headers },
+    ...init,
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({ message: res.statusText }));
+    throw new Error(body.message || body.error || `HTTP ${res.status}`);
+  }
+  return res.json();
+}
+
+// Certificates
+export const getCertificates = (params: Record<string, string> = {}) => {
+  const qs = new URLSearchParams({ page: '1', per_page: '50', ...params }).toString();
+  return fetchJSON<PaginatedResponse<Certificate>>(`${BASE}/certificates?${qs}`);
+};
+
+export const getCertificate = (id: string) =>
+  fetchJSON<Certificate>(`${BASE}/certificates/${id}`);
+
+export const getCertificateVersions = (id: string) =>
+  fetchJSON<PaginatedResponse<CertificateVersion>>(`${BASE}/certificates/${id}/versions`);
+
+export const createCertificate = (data: Partial<Certificate>) =>
+  fetchJSON<Certificate>(`${BASE}/certificates`, { method: 'POST', body: JSON.stringify(data) });
+
+export const triggerRenewal = (id: string) =>
+  fetchJSON<{ message: string }>(`${BASE}/certificates/${id}/renew`, { method: 'POST' });
+
+export const triggerDeployment = (id: string, targetId: string) =>
+  fetchJSON<{ message: string }>(`${BASE}/certificates/${id}/deploy`, {
+    method: 'POST',
+    body: JSON.stringify({ target_id: targetId }),
+  });
+
+// Agents
+export const getAgents = (params: Record<string, string> = {}) => {
+  const qs = new URLSearchParams({ page: '1', per_page: '50', ...params }).toString();
+  return fetchJSON<PaginatedResponse<Agent>>(`${BASE}/agents?${qs}`);
+};
+
+export const getAgent = (id: string) =>
+  fetchJSON<Agent>(`${BASE}/agents/${id}`);
+
+// Jobs
+export const getJobs = (params: Record<string, string> = {}) => {
+  const qs = new URLSearchParams({ page: '1', per_page: '50', ...params }).toString();
+  return fetchJSON<PaginatedResponse<Job>>(`${BASE}/jobs?${qs}`);
+};
+
+export const cancelJob = (id: string) =>
+  fetchJSON<{ message: string }>(`${BASE}/jobs/${id}/cancel`, { method: 'POST' });
+
+// Notifications
+export const getNotifications = (params: Record<string, string> = {}) => {
+  const qs = new URLSearchParams({ page: '1', per_page: '50', ...params }).toString();
+  return fetchJSON<PaginatedResponse<Notification>>(`${BASE}/notifications?${qs}`);
+};
+
+// Audit
+export const getAuditEvents = (params: Record<string, string> = {}) => {
+  const qs = new URLSearchParams({ page: '1', per_page: '50', ...params }).toString();
+  return fetchJSON<PaginatedResponse<AuditEvent>>(`${BASE}/audit?${qs}`);
+};
+
+// Policies
+export const getPolicies = (params: Record<string, string> = {}) => {
+  const qs = new URLSearchParams({ page: '1', per_page: '50', ...params }).toString();
+  return fetchJSON<PaginatedResponse<PolicyRule>>(`${BASE}/policies?${qs}`);
+};
+
+// Issuers
+export const getIssuers = (params: Record<string, string> = {}) => {
+  const qs = new URLSearchParams({ page: '1', per_page: '50', ...params }).toString();
+  return fetchJSON<PaginatedResponse<Issuer>>(`${BASE}/issuers?${qs}`);
+};
+
+// Targets
+export const getTargets = (params: Record<string, string> = {}) => {
+  const qs = new URLSearchParams({ page: '1', per_page: '50', ...params }).toString();
+  return fetchJSON<PaginatedResponse<Target>>(`${BASE}/targets?${qs}`);
+};
+
+// Health
+export const getHealth = () => fetchJSON<{ status: string }>('/health');