feat: bundle agent executables + web-driven claude login

Two changes so an operator can stand up and authenticate Handler entirely
from the browser, with a self-contained control image.

Bundle executables in the control image (Dockerfile.control)
- Node.js (NodeSource) + the Claude Code CLI, mise (official apt repo), and
  forge (git-pkgs/forge, built in a Go stage) join the existing git/tmux/ssh.
  No more bring-your-own binaries: live agent spawning, the verification gate,
  CI resolution, and the login flow all work out of the box. Installed under
  /usr so the /var/lib/handler VOLUME never masks them; mise apt source pinned
  to $TARGETARCH for the multi-arch (amd64/arm64) build.

Claude login from the web UI
- New login_start / login_submit command types (migration 0005) drive the
  interactive `claude /login` through the same enqueue→worker handoff every
  other control action uses — the API container has no claude binary.
- control/login.py opens `claude` in a dedicated tmux session, sends /login,
  selects the subscription account, and scrapes the claude.com authorization
  URL (tmux.capture_pane, -pJ so a wrapped URL rejoins); a second command feeds
  back the pasted code. Fully mockable via the tmux seam.
- API: POST /login/start, POST /login/submit (admin-gated).
- Dashboard: a "Claude Login" pane — a button that starts the flow, embeds the
  URL in an iframe (with a new-tab fallback, since claude.com may refuse
  framing), and takes the code to finish.

Also un-ignores frontend/lib/ (a broad Python `lib/` rule was swallowing the
UI's own api client + formatters, breaking rebuilds from a fresh clone) and
reconstructs those two source files; rebuilt static export committed.

Tests: control/login unit tests (tmux faked), worker dispatch, and API route
tests. Full suite green (195 tests), ruff clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YKVyBmKvWDVgrFC9WER2f2

frontend/components/Dashboard.tsx

@@ -12,6 +12,7 @@ import { ApprovalsSection } from "@/components/sections/ApprovalsSection";
 import { GitServersSection } from "@/components/sections/GitServersSection";
 import { ActivitySection } from "@/components/sections/ActivitySection";
 import { SharedSection } from "@/components/sections/SharedSection";
+import { LoginSection } from "@/components/sections/LoginSection";
 
 interface NavDef {
   key: Section;
@@ -34,6 +35,13 @@ const NAV: NavDef[] = [
   { key: "servers", label: "Git Servers", count: (s) => s.hosts.length },
   { key: "activity", label: "Activity", count: (s) => s.commands.length },
   { key: "shared", label: "Shared", count: (s) => s.shared.context.length },
+  {
+    key: "login",
+    label: "Claude Login",
+    count: () => 0,
+    // Draw the eye to it until Claude is logged in on the host this session.
+    accent: (s) => s.claudeLogin.status !== "done",
+  },
 ];
 
 export function Dashboard({ onSignOut }: { onSignOut: () => void }) {
@@ -97,6 +105,7 @@ export function Dashboard({ onSignOut }: { onSignOut: () => void }) {
             {s.section === "servers" && <GitServersSection />}
             {s.section === "activity" && <ActivitySection />}
             {s.section === "shared" && <SharedSection />}
+            {s.section === "login" && <LoginSection />}
           </div>
         )}
       </main>