feat(web): complete Core capability workspace

[sam2tom]

Summary

• add a protocol-honest capability dashboard, Agent catalog/templates, and direct Agent editing UX
• add supported Function and HTTP MCP configuration, callback handling, Vault credential flows, Session input/tool controls, Environment files, and Source Files views
• keep Core/runtime capability boundaries fail-closed and document the pinned Parsar protocol evidence
• expand typed client coverage, fixtures, component tests, and end-to-end acceptance across responsive layouts

This is the current maintainer-requested Web integration batch. It completes the bounded Function/MCP work in #30 and includes the subsequent Web-only capability and UX iterations. Follow-up issues #31 through #36 remain open.

Closes #30

Validation

• root syntax checks: passed
• root tests: 67 passed
• Web typecheck: passed
• Agents Client typecheck: passed
• Web tests: 56 files / 551 tests passed
• Agents Client tests: 3 files / 214 tests passed
• Vite production build: passed
• git diff --check: passed

The local pnpm check wrapper could not verify the pnpm 10.30.3 registry signature because its registry fetches failed. The existing installed dependencies were used to run every underlying check above; GitHub CI remains the merge gate.

Boundaries

• Web and reusable TypeScript client only; no Parsar Core changes
• no paid provider call or deployment
• no branch or Worktree deletion