feat: bundle agent executables + web-driven claude login

Two changes so an operator can stand up and authenticate Handler entirely
from the browser, with a self-contained control image.

Bundle executables in the control image (Dockerfile.control)
- Node.js (NodeSource) + the Claude Code CLI, mise (official apt repo), and
  forge (git-pkgs/forge, built in a Go stage) join the existing git/tmux/ssh.
  No more bring-your-own binaries: live agent spawning, the verification gate,
  CI resolution, and the login flow all work out of the box. Installed under
  /usr so the /var/lib/handler VOLUME never masks them; mise apt source pinned
  to $TARGETARCH for the multi-arch (amd64/arm64) build.

Claude login from the web UI
- New login_start / login_submit command types (migration 0005) drive the
  interactive `claude /login` through the same enqueue→worker handoff every
  other control action uses — the API container has no claude binary.
- control/login.py opens `claude` in a dedicated tmux session, sends /login,
  selects the subscription account, and scrapes the claude.com authorization
  URL (tmux.capture_pane, -pJ so a wrapped URL rejoins); a second command feeds
  back the pasted code. Fully mockable via the tmux seam.
- API: POST /login/start, POST /login/submit (admin-gated).
- Dashboard: a "Claude Login" pane — a button that starts the flow, embeds the
  URL in an iframe (with a new-tab fallback, since claude.com may refuse
  framing), and takes the code to finish.

Also un-ignores frontend/lib/ (a broad Python `lib/` rule was swallowing the
UI's own api client + formatters, breaking rebuilds from a fresh clone) and
reconstructs those two source files; rebuilt static export committed.

Tests: control/login unit tests (tmux faked), worker dispatch, and API route
tests. Full suite green (195 tests), ruff clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YKVyBmKvWDVgrFC9WER2f2

docker-compose.yml

@@ -33,9 +33,9 @@ services:
   # Shares the database and the handler-data volume with the API. It waits for the API
   # (which owns migrations), so RUN_MIGRATIONS is off here to avoid a startup race. Run
   # one-shot control commands against the same image with, e.g.,
-  # `docker compose run --rm control handler list`. Live agent spawning also needs
-  # `git`/`tmux` (baked in) plus bring-your-own `claude`/`forge` binaries — layer or mount
-  # those in.
+  # `docker compose run --rm control handler list`. Every executable it shells out to —
+  # `git`, `tmux`, `node`+`claude`, `mise`, `forge` — is bundled in the image, so live
+  # agent spawning and the claude web-login flow work with no bring-your-own binaries.
   control:
     image: ghcr.io/0xwheatyz/handler/control:latest
     build: