v0.7.8: WebUI (--web): HTTP/1.1 + SSE front end, engine API v1, tests

A second implementation of cst_agent_hooks_t next to the TUI: the turn runs on
a worker thread, the hooks publish events into a ring buffer that SSE clients
read, so the engine itself needs no changes.

- src/net.c, include/cst_net.h: POSIX/Winsock sockets, non-blocking connect
- src/http_srv.c, include/cst_http.h: HTTP/1.1, keep-alive, chunked streaming,
  body caps (413), Expect: 100-continue, connection cap, exact routing
- src/web_md.c, include/cst_web_md.h: streaming markdown -> sanitized HTML
  (tag/attribute allowlist, javascript: URLs and off-site images dropped)
- src/webui.c, include/cst_webui.h: event ring + SSE broadcast, all routes,
  token (Bearer/Cookie/query) and loopback Host checks, 3 s auto-deny when no
  client is attached
- src/webui_stub.c, CST_WEBUI=0 / CST_BUILD_WEBUI=OFF: build without the WebUI
- web/: no-build front end (transcript, approvals, todo, sessions, image
  upload, status bar)
- docs/webui.md: engine API v1 - events, requests, security model
- tests/test_webui.c, scripts/e2e_webui.sh: unit tests plus an end-to-end run
  driven by a recorded SSE stream (no API key needed)
- src/main.c: --web --web-port --web-host --web-token --web-dev --web-open
  and CST_WEB_PORT/HOST/TOKEN/ROOT

An empty POST body is now accepted without Content-Length (RFC 9112 6.3) so
curl-driven clients can reach cancel/undo/compact/quit; CMakeList's core tests
learned about sashidown and test_webui, and CST_WEBUI=0 defines CST_NO_WEBUI.

README.md

@@ -126,6 +126,23 @@ API Key：TUI 里输入并按 provider 保存到配置目录的 `credentials`（
 | Android Termux | aarch64 / … | Clang (Termux) | yes | ncurses（Termux 包） | `$PREFIX/bin/sh`；可旁路 busybox |
 | Windows 10 1903+ | x86_64 | MinGW-w64 GCC（UCRT） | yes | ncurses 6.6（Windows 控制台） | **捆绑 busybox-w32** |
 
+### WebUI（`--web`）
+
+同一个二进制内置一个 HTTP + SSE 前端：`cst-agent --web`（默认 `http://127.0.0.1:8787/`）。
+它和 TUI 是同一引擎的两个前端，浏览器里能流式看回答、点审批、切会话、贴图。
+协议是一份稳定的 JSON + SSE 接口，供以后的专用客户端复用。详见 [docs/webui.md](docs/webui.md)。
+
+```bash
+cst-agent --web                    # 本机浏览器打开 http://127.0.0.1:8787/
+cst-agent --web --web-port 0       # 端口交给系统，启动日志里给 URL
+cst-agent --web --web-dev ./web    # 开发前端：直接读目录，改完刷新
+cst-agent --web --web-host 0.0.0.0 --web-token 口令   # 手机/局域网访问
+sh scripts/e2e_webui.sh            # 用录制流跑完整轮次，不需要 API key
+```
+
+不带 TUI 的构建也可以开 WebUI（`cmake -DCST_BUILD_WEBUI=ON -DCST_BUILD_TUI=OFF`）；
+`-DCST_BUILD_WEBUI=OFF` 时 `--web` 只打印一条提示。
+
 ### Termux
 
 ```bash