Management API, service binary and host probes

TLS-only HTTP API with Argon2id auth, setup token, CSRF, TOTP, login throttling,
management source allow-list; network apply via helper; capture endpoints;
SSE events; crash recovery of interrupted segments; systemd notify/watchdog.

.gitignore

@@ -1,4 +1,5 @@
 /dist/
 /web/node_modules/
-/web/dist/
+/web/dist/*
+!/web/dist/.gitkeep
 *.test