Management API, service binary and host probes

TLS-only HTTP API with Argon2id auth, setup token, CSRF, TOTP, login throttling,
management source allow-list; network apply via helper; capture endpoints;
SSE events; crash recovery of interrupted segments; systemd notify/watchdog.

web/embed.go

@@ -0,0 +1,16 @@
+// Package web embeds the built management UI (web/dist, produced by `npm run build`).
+package web
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed all:dist
+var dist embed.FS
+
+// FS returns the built UI rooted at dist/.
+func FS() fs.FS {
+	f, _ := fs.Sub(dist, "dist")
+	return f
+}