feat: built-in read-only dashboard at /ui + GET /runs

Serves a self-contained vanilla-JS dashboard (embedded via go:embed): a per-model performance table — runs, minutes, findings, confirmed/false-positive/ungraded, points, points-per-minute, points-per-run, by-severity — with drill-down filters (date range, repo, provider, model, lens, grade/severity), free-text search, and a click-to-scope findings detail table.

Scoring stays client-side: the page has an editable points curve and computes points + value-per-minute in the browser, so the store remains point-free. Adds GET /runs (lists all runs, incl. zero-finding ones) so minutes/runs are filterable. The /ui shell is public (carries no data); data endpoints stay token-gated and the JS sends the token.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ui.go

@@ -0,0 +1,12 @@
+package main
+
+import _ "embed"
+
+// uiHTML is the self-contained, read-only dashboard served at /ui. It is a single
+// vanilla-JS page (no external assets) that fetches the raw /runs and /export
+// data and does ALL filtering, drill-down, and scoring in the browser — keeping
+// the daemon a pure fact store (points/value-per-minute are computed client-side
+// from an editable curve).
+//
+//go:embed ui.html
+var uiHTML string