v0.7.8: WebUI (--web): HTTP/1.1 + SSE front end, engine API v1, tests

A second implementation of cst_agent_hooks_t next to the TUI: the turn runs on
a worker thread, the hooks publish events into a ring buffer that SSE clients
read, so the engine itself needs no changes.

- src/net.c, include/cst_net.h: POSIX/Winsock sockets, non-blocking connect
- src/http_srv.c, include/cst_http.h: HTTP/1.1, keep-alive, chunked streaming,
  body caps (413), Expect: 100-continue, connection cap, exact routing
- src/web_md.c, include/cst_web_md.h: streaming markdown -> sanitized HTML
  (tag/attribute allowlist, javascript: URLs and off-site images dropped)
- src/webui.c, include/cst_webui.h: event ring + SSE broadcast, all routes,
  token (Bearer/Cookie/query) and loopback Host checks, 3 s auto-deny when no
  client is attached
- src/webui_stub.c, CST_WEBUI=0 / CST_BUILD_WEBUI=OFF: build without the WebUI
- web/: no-build front end (transcript, approvals, todo, sessions, image
  upload, status bar)
- docs/webui.md: engine API v1 - events, requests, security model
- tests/test_webui.c, scripts/e2e_webui.sh: unit tests plus an end-to-end run
  driven by a recorded SSE stream (no API key needed)
- src/main.c: --web --web-port --web-host --web-token --web-dev --web-open
  and CST_WEB_PORT/HOST/TOKEN/ROOT

An empty POST body is now accepted without Content-Length (RFC 9112 6.3) so
curl-driven clients can reach cancel/undo/compact/quit; CMakeList's core tests
learned about sashidown and test_webui, and CST_WEBUI=0 defines CST_NO_WEBUI.

scripts/embed_web.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# Embed web/ into .gen/web_assets.inc as C byte arrays (the same trick the
+# Makefile uses for src/models_builtin.json). POSIX sh on purpose: the musl
+# and busybox build environments have no bash.  Usage:
+#   sh scripts/embed_web.sh [out.inc] [web-dir]
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+OUT="${1:-$ROOT/.gen/web_assets.inc}"
+DIR="${2:-$ROOT/web}"
+
+FILES="index.html app.js style.css favicon.svg"
+
+mkdir -p "$(dirname "$OUT")"
+{
+  echo "/* Generated by scripts/embed_web.sh from web/ - do not edit. */"
+  for f in $FILES; do
+    [ -f "$DIR/$f" ] || continue
+    var="wui_asset_$(echo "$f" | tr -c 'a-zA-Z0-9' '_')"
+    echo "static const unsigned char ${var}[] = {"
+    od -An -v -tx1 "$DIR/$f" | sed 's/\([0-9a-f][0-9a-f]\)/0x\1,/g'
+    echo "0x00};"
+  done
+  echo "static const wui_asset_t wui_assets[] = {"
+  for f in $FILES; do
+    [ -f "$DIR/$f" ] || continue
+    var="wui_asset_$(echo "$f" | tr -c 'a-zA-Z0-9' '_')"
+    case "$f" in
+      *.html) ctype="text/html; charset=utf-8" ;;
+      *.js)   ctype="text/javascript; charset=utf-8" ;;
+      *.css)  ctype="text/css; charset=utf-8" ;;
+      *.svg)  ctype="image/svg+xml" ;;
+      *)      ctype="application/octet-stream" ;;
+    esac
+    echo "  {\"$f\", \"$ctype\", ${var}, sizeof(${var}) - 1},"
+  done
+  echo "};"
+  echo "static const int wui_asset_count = (int)(sizeof(wui_assets) / sizeof(wui_assets[0]));"
+} > "$OUT.tmp"
+mv "$OUT.tmp" "$OUT"
+echo "embedded $(wc -c < "$OUT") bytes of C into $OUT"