Hub: add read-only web dashboard

[raelovejoy]

Summary

• add a separate read-only Hub web dashboard;
• expose the same live Hub inventory already available in the CLI;
• keep localhost as the default bind;
• add an explicit Tailscale-only mode with a temporary browser token;
• add no write/action API in this first web slice.

Exposure

The Tailscale mode binds only to the detected Tailscale IPv4 address and does not use a wildcard listener.