refactor: archive GUI clients; keep minimal TUI with hooks/API

Move Qt/Tauri/full Web SPA under archive/, ship hermit as CLI/TUI plus
libcstcore and cst-webui/1 HTTP+SSE (turn lifecycle hooks, capabilities).

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/e2e_webui_http.py

@@ -141,8 +141,10 @@ try:
     check(status(r)[:1] == [200], "a client without Origin (curl) may POST")
     r = raw(PORT, req("GET", "/api/attach/img-0000.png", host="evil.example"))
     check(status(r)[:1] == [401], "session images need the Host check too (%s)" % status(r))
-    r = raw(PORT, req("GET", "/app.js"))
-    check(status(r)[:1] == [200], "assets are served")
+    r = raw(PORT, req("GET", "/"))
+    check(status(r)[:1] == [200], "health page is served")
+    r = raw(PORT, req("GET", "/index.html"))
+    check(status(r)[:1] == [200], "embedded index.html is served")
     # 2. request parsing
     r = raw(PORT, req("GET", "/api/state%00x"))
     check(status(r)[:1] == [400], "an encoded NUL in the path is a 400 (%s)" % status(r))
@@ -206,8 +208,10 @@ try:
     ws2 = os.path.join(root, "b")
     os.makedirs(ws2)
     p, PORT, log = start(ws2, "--web-token", "tok-x")
-    r = raw(PORT, req("GET", "/app.js"))
-    check(status(r)[:1] == [200], "token mode: app.js loads without the token (%s)" % status(r))
+    r = raw(PORT, req("GET", "/"))
+    check(status(r)[:1] == [200], "token mode: health page loads without the token (%s)" % status(r))
+    r = raw(PORT, req("GET", "/index.html"))
+    check(status(r)[:1] == [200], "token mode: index.html loads without the token (%s)" % status(r))
     r = raw(PORT, req("GET", "/api/state"))
     check(status(r)[:1] == [401], "token mode: the API needs it")
     r = raw(PORT, req("GET", "/api/attach/img-0000.png"))