feat(ui): hopperui web UI module (M8)

[giraffesyo]

Last of the M8 PRs: the hopperui module. With it, M8 is complete.

What changed

• hopperui (separate module, replace ../ like hopperotel; stdlib only): hopperui.New(client, cfg) http.Handler, mounted under a prefix with http.StripPrefix. Pages: overview and queues (depths, oldest waiting, completions/min, limits, paused state), jobs and history (filtered by queue, state and kind; paged by ID), job detail (args, metadata, output, errors with traces, keys, batch link), workflows as a DAG (SVG laid out by dependency depth, nodes colored by state, linked to jobs), subscriptions, stream consumers (with seek forms), clients. Server-rendered HTML, no scripts, no external assets, dark mode via prefers-color-scheme.
• Authorization: retry, cancel, pause, resume and seek are offered only when Config.Authorize(r, action) is supplied; it is asked before every action. Without it the UI is read-only and says so in the header.
• hopperui/cmd/hopperui: a standalone server (-database-url, -listen, -prefix, -allow-actions) for operators who do not embed the handler.
• Core: JobFilter.After so listings can page (the driver already supported it).
• Tests: hopperui_test.go renders every page against a real schema and exercises the action paths (refused without a hook, refused by the hook, applied), 400/404s, and the DAG (edges and labels). Verified visually against a seeded schema as well.
• Wiring: Makefile, CI lint/tidy/test steps and dependabot cover the new module (dependabot also gains hopperotel, which it had missed); README, plan §13 and §16, operations doc, changelog.

hopperbench

No hot-path changes.