Implement M5: hardening, input validation, and Vite+React+TS dashboard

Backend hardening:
- Fix 6 nginx.go non-constant format string build errors
- Add validation.go with hostname, PEM, and enum validators
- Apply input validation to all POST/PUT handlers (certificates,
  agents, CSR, policies, teams, owners, targets, issuers)
- Fix unchecked JSON decode in TriggerDeployment handler

Frontend (Vite + React + TypeScript):
- Migrate from single-file SPA to proper build pipeline
- 7 pages: Dashboard, Certificates (list+detail), Agents, Jobs,
  Notifications, Policies, Audit Trail
- TanStack Query for server state with auto-refetch intervals
- Certificate detail with version history and renewal trigger
- Job cancellation, status/type filtering, expiry countdowns
- Reusable components: DataTable, StatusBadge, ErrorState, PageHeader
- Dark theme with Tailwind CSS, sidebar nav via React Router

Server integration:
- Go server serves web/dist/ (Vite output) with SPA fallback
- Falls back to web/index.html for legacy mode
- .gitignore updated for web/node_modules/ and web/dist/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/src/components/StatusBadge.tsx

@@ -0,0 +1,29 @@
+const statusStyles: Record<string, string> = {
+  Active:              'badge-success',
+  Expiring:            'badge-warning',
+  Expired:             'badge-danger',
+  RenewalInProgress:   'badge-info',
+  PendingIssuance:     'badge-info',
+  Archived:            'badge-neutral',
+  Revoked:             'badge-danger',
+  // Job statuses
+  Pending:             'badge-info',
+  Running:             'badge-warning',
+  Completed:           'badge-success',
+  Failed:              'badge-danger',
+  Cancelled:           'badge-neutral',
+  // Agent statuses
+  Online:              'badge-success',
+  Offline:             'badge-danger',
+  Stale:               'badge-warning',
+  // Notification statuses
+  sent:                'badge-success',
+  pending:             'badge-warning',
+  failed:              'badge-danger',
+  read:                'badge-neutral',
+};
+
+export default function StatusBadge({ status }: { status: string }) {
+  const cls = statusStyles[status] || 'badge-neutral';
+  return <span className={`badge ${cls}`}>{status}</span>;
+}