feat: bundle agent executables + web-driven claude login

Two changes so an operator can stand up and authenticate Handler entirely
from the browser, with a self-contained control image.

Bundle executables in the control image (Dockerfile.control)
- Node.js (NodeSource) + the Claude Code CLI, mise (official apt repo), and
  forge (git-pkgs/forge, built in a Go stage) join the existing git/tmux/ssh.
  No more bring-your-own binaries: live agent spawning, the verification gate,
  CI resolution, and the login flow all work out of the box. Installed under
  /usr so the /var/lib/handler VOLUME never masks them; mise apt source pinned
  to $TARGETARCH for the multi-arch (amd64/arm64) build.

Claude login from the web UI
- New login_start / login_submit command types (migration 0005) drive the
  interactive `claude /login` through the same enqueue→worker handoff every
  other control action uses — the API container has no claude binary.
- control/login.py opens `claude` in a dedicated tmux session, sends /login,
  selects the subscription account, and scrapes the claude.com authorization
  URL (tmux.capture_pane, -pJ so a wrapped URL rejoins); a second command feeds
  back the pasted code. Fully mockable via the tmux seam.
- API: POST /login/start, POST /login/submit (admin-gated).
- Dashboard: a "Claude Login" pane — a button that starts the flow, embeds the
  URL in an iframe (with a new-tab fallback, since claude.com may refuse
  framing), and takes the code to finish.

Also un-ignores frontend/lib/ (a broad Python `lib/` rule was swallowing the
UI's own api client + formatters, breaking rebuilds from a fresh clone) and
reconstructs those two source files; rebuilt static export committed.

Tests: control/login unit tests (tmux faked), worker dispatch, and API route
tests. Full suite green (195 tests), ruff clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YKVyBmKvWDVgrFC9WER2f2

tests/test_worker.py

@@ -6,7 +6,7 @@ machinery (already covered by test_control_spawn)."""
 
 from __future__ import annotations
 
-from handler.control import poller, spawn, worker
+from handler.control import login, poller, spawn, worker
 from handler.db import repository as repo
 from handler.db.engine import get_engine
 
@@ -107,6 +107,53 @@ def test_poll_ci_command_returns_summary(env, monkeypatch):
     assert done["result"] == {"checked": 0, "resolved": 0, "pending": 0}
 
 
+def test_login_start_command_returns_url(env, monkeypatch):
+    monkeypatch.setattr(
+        login, "start", lambda: {"session": "handler__login", "url": "https://claude.ai/oauth"}
+    )
+    cmd = _enqueue(type="login_start")
+
+    worker.drain("w")
+    done = _get(cmd["id"])
+    assert done["status"] == "done"
+    assert done["result"]["url"] == "https://claude.ai/oauth"
+
+
+def test_login_submit_command_feeds_code(env, monkeypatch):
+    seen = {}
+
+    def fake_submit(code):
+        seen["code"] = code
+        return {"success": True, "output": "Login successful"}
+
+    monkeypatch.setattr(login, "submit_code", fake_submit)
+    cmd = _enqueue(type="login_submit", payload={"code": "auth-123"})
+
+    worker.drain("w")
+    done = _get(cmd["id"])
+    assert done["status"] == "done"
+    assert done["result"]["success"] is True
+    assert seen["code"] == "auth-123"
+
+
+def test_login_submit_failure_is_recorded_failed(env, monkeypatch):
+    monkeypatch.setattr(
+        login, "submit_code", lambda code: {"success": False, "output": "Invalid code"}
+    )
+    cmd = _enqueue(type="login_submit", payload={"code": "bad"})
+
+    worker.drain("w")
+    failed = _get(cmd["id"])
+    assert failed["status"] == "failed"
+    assert "Invalid code" in failed["error"]
+
+
+def test_login_submit_without_code_is_failed(env):
+    cmd = _enqueue(type="login_submit", payload={})
+    assert worker.drain("w") == 1
+    assert _get(cmd["id"])["status"] == "failed"
+
+
 def test_bad_command_is_recorded_failed_not_raised(env):
     # spawn with no agent name -> CommandError -> the worker records 'failed', keeps going.
     _seed_project()