v0.7.8: WebUI (--web): HTTP/1.1 + SSE front end, engine API v1, tests

A second implementation of cst_agent_hooks_t next to the TUI: the turn runs on
a worker thread, the hooks publish events into a ring buffer that SSE clients
read, so the engine itself needs no changes.

- src/net.c, include/cst_net.h: POSIX/Winsock sockets, non-blocking connect
- src/http_srv.c, include/cst_http.h: HTTP/1.1, keep-alive, chunked streaming,
  body caps (413), Expect: 100-continue, connection cap, exact routing
- src/web_md.c, include/cst_web_md.h: streaming markdown -> sanitized HTML
  (tag/attribute allowlist, javascript: URLs and off-site images dropped)
- src/webui.c, include/cst_webui.h: event ring + SSE broadcast, all routes,
  token (Bearer/Cookie/query) and loopback Host checks, 3 s auto-deny when no
  client is attached
- src/webui_stub.c, CST_WEBUI=0 / CST_BUILD_WEBUI=OFF: build without the WebUI
- web/: no-build front end (transcript, approvals, todo, sessions, image
  upload, status bar)
- docs/webui.md: engine API v1 - events, requests, security model
- tests/test_webui.c, scripts/e2e_webui.sh: unit tests plus an end-to-end run
  driven by a recorded SSE stream (no API key needed)
- src/main.c: --web --web-port --web-host --web-token --web-dev --web-open
  and CST_WEB_PORT/HOST/TOKEN/ROOT

An empty POST body is now accepted without Content-Length (RFC 9112 6.3) so
curl-driven clients can reach cancel/undo/compact/quit; CMakeList's core tests
learned about sashidown and test_webui, and CST_WEBUI=0 defines CST_NO_WEBUI.

src/main.c

@@ -3,6 +3,7 @@
 #include "cst_models.h"
 #include "cst_tools.h"
 #include "cst_version.h"
+#include "cst_webui.h"
 #include "os_compat.h"
 
 #include <curl/curl.h>
@@ -41,6 +42,13 @@ static void usage(const char *argv0) {
           "  -T, --tools PROFILE   default (all tools) | minimal (paper set)\n"
           "  -n, --max-steps N     model calls per turn (30)\n"
           "  -H, --headless -p TEXT  run one prompt without the TUI\n"
+          "      --web             serve the UI over HTTP on 127.0.0.1:8787\n"
+          "      --web-port N      port (0 = pick a free one)\n"
+          "      --web-host ADDR   bind address (default 127.0.0.1; a\n"
+          "                        non-loopback address requires a token)\n"
+          "      --web-token T     require ?token=T / Authorization: Bearer T\n"
+          "      --web-dev DIR     serve the UI from DIR (development)\n"
+          "      --web-open        open the browser at startup\n"
           "  -a, --ask-key         enter and save the provider's API key\n"
           "  -k, --api-key KEY     use KEY for this run only (not saved)\n"
           "  -b, --api-base URL    OpenAI-compatible base URL (…/v1)\n"
@@ -320,6 +328,16 @@ int main(int argc, char **argv) {
   const char *prompt = NULL;
   int new_session = 0, do_list = 0;
   const char *resume_id = NULL;
+  /* WebUI (--web): a second front end on the same engine. */
+  int web_mode = 0;
+  cst_webui_opts_t web;
+  memset(&web, 0, sizeof(web));
+  const char *env = getenv("CST_WEB_PORT");
+  if (env && env[0])
+    web.port = atoi(env);
+  web.host = getenv("CST_WEB_HOST");
+  web.token = getenv("CST_WEB_TOKEN");
+  web.root = getenv("CST_WEB_ROOT");
 
   static struct option opts[] = {
       {"workspace", required_argument, 0, 'w'},
@@ -346,6 +364,12 @@ int main(int argc, char **argv) {
       {"help", no_argument, 0, 'h'},
       {"version", no_argument, 0, 'V'},
       {"list-models", optional_argument, 0, 0x100},
+      {"web", no_argument, 0, 0x101},
+      {"web-port", required_argument, 0, 0x102},
+      {"web-host", required_argument, 0, 0x103},
+      {"web-token", required_argument, 0, 0x104},
+      {"web-dev", required_argument, 0, 0x105},
+      {"web-open", no_argument, 0, 0x106},
       {0, 0, 0, 0}};
   int c;
   while ((c = getopt_long(argc, argv, "w:s:b:k:m:P:r:n:T:Hp:dahVNcR:LyA:C:e:", opts, NULL)) !=
@@ -453,6 +477,29 @@ int main(int argc, char **argv) {
       curl_global_cleanup();
       return rc;
     }
+    case 0x101:
+      web_mode = 1;
+      break;
+    case 0x102:
+      web.port = atoi(optarg);
+      web_mode = 1;
+      break;
+    case 0x103:
+      web.host = optarg;
+      web_mode = 1;
+      break;
+    case 0x104:
+      web.token = optarg;
+      web_mode = 1;
+      break;
+    case 0x105:
+      web.root = optarg;
+      web_mode = 1;
+      break;
+    case 0x106:
+      web.open_browser = 1;
+      web_mode = 1;
+      break;
     case 'V':
       printf("cst-agent %s\n", CST_VERSION);
       curl_global_cleanup();
@@ -600,7 +647,7 @@ int main(int argc, char **argv) {
       return 0;
     }
   }
-  if (!cfg.api_key[0] && cfg.headless) {
+  if (!cfg.api_key[0] && (cfg.headless || web_mode)) {
     fprintf(stderr,
             "no API key for %s: start cst-agent once to enter it, or run "
             "cst-agent --ask-key --provider %s\n",
@@ -610,7 +657,7 @@ int main(int argc, char **argv) {
   }
   /* Router presets have no fixed model: take the first one the API lists
    * (the TUI does the same after its /models probe). */
-  if (!cfg.model[0] && cfg.headless) {
+  if (!cfg.model[0] && (cfg.headless || web_mode)) {
     static cst_model_meta_t list[512];
     char err[256] = "";
     long age = 0;
@@ -654,7 +701,10 @@ int main(int argc, char **argv) {
   }
 
   int rc = 0;
-  if (cfg.headless) {
+  if (web_mode) {
+    web.prompt = prompt; /* --web -p "...": run one turn at startup */
+    rc = cst_webui_run(agent, &web);
+  } else if (cfg.headless) {
     if (!prompt) {
       fprintf(stderr, "--headless requires --prompt\n");
       rc = 1;