feat: Mantine SPA (Cluster/Rooms/Users) + verified end-to-end

SPA (React 19 + Vite 6 + Mantine v9, dark/indigo, @fn_library-style):
- AdminShell: AppShell nav (Cluster/Rooms/Users), operator endpoint badge
- ClusterPage: per-node up/down + posture badges (enforce/acl/tls/cluster/store),
  10s auto-refresh
- RoomsPage: room table (E2E/cleartext, persist, signed, epoch, role), create
  modal, members drawer with kick(+rekey) and invite modal
- UsersPage: allowlist table (handle/role/status/sign_pub), add modal, revoke
  with confirmation, degraded state when no store backend
- api.ts: single repository layer hitting /api; gateway decides mock vs live

Verified end-to-end against a local membershipd in BOTH postures:
- auth-off: create room, list rooms, signed members GET, add/revoke user
- enforce + TLS + nkey (production posture): TLS-pinned healthz, nkey NATS
  connect, signed control-plane requests verified by the server, 403 surfaced
  for a non-member room

pnpm build green (tsc + vite); go build/vet green; dist embedded.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "unibus-admin-web",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc -b && vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@mantine/core": "^9.3.0",
+    "@mantine/hooks": "^9.3.0",
+    "@mantine/notifications": "^9.3.0",
+    "@tabler/icons-react": "^3.36.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
+    "@vitejs/plugin-react": "^4.3.4",
+    "postcss": "^8.4.49",
+    "postcss-preset-mantine": "^1.17.0",
+    "postcss-simple-vars": "^7.0.1",
+    "typescript": "~5.6.3",
+    "vite": "^6.0.3"
+  }
+}