ui: adds initial local ui/apn work

[lePereT]

What type of PR is this? (check all applicable)

• 🍕 Feature
• 🐛 Bug Fix
• 📝 Documentation Update
• ✅ Test

Description

WIP local UI integration for devicecode.

This adds a self-standing fallback local UI to devicecode while the full Vue/Tailwind local UI continues to be updated in its separate repository. It also adds the initial API and service seams needed by that UI, including a curated local UI bootstrap model and prototype APN management mediated by the GSM service.

Changes included:

• Adds a fallback www/ local UI so devicecode can be run and tested without the external UI bundle.
• Adds GET /api/local-ui/bootstrap, returning a curated retained-state model for the local UI.
• Keeps live UI updates on the existing /events SSE stream rather than recreating the old /event-stats model.
• Adds GET /api/gsm/apns/custom and PUT /api/gsm/apns/custom as UI-facing routes.
• Moves custom APN persistence behind GSM-owned capability methods, with durable storage through the HAL control-store.
• Adds GSM APN validation, normalisation, ranking, retained state publication and minimal redaction.
• Redacts APN secrets from retained state and from the local UI bootstrap model.
• Keeps /api/gsm/apns/custom returning full APN records for prototype admin-network use.
• Adds a stubbed GET /api/diagnostics response, pending a later diagnostics service pass.
• Adds SPA fallback and PWA/static MIME handling to the UI static server.
• Uses fibers.coxpcall in UI HTTP paths that may touch yielding operations, fixing Lua 5.1 yield-safety failures not seen under LuaJIT.
• Adds a devhost demo that runs real HTTP/UI/GSM services with a fake HAL control-store for APNs.
• Adds integration/devhost and unit coverage for the local UI and APN bridge.

This deliberately avoids a full GSM service modernisation. The APN work is a bounded transitional bridge so that UI no longer edits config or talks directly to HAL. A later GSM migration should move the service to the current service-architecture.md idioms, including config_watch, dependency gating, request ownership and explicit backpressure.

Related Issues, Tickets & Documents

Relevant documents:

• docs/service-architecture.md
• docs/devhost/local-ui-demo.md

Manual test

• 👍 yes

Manual test description

All relevant integration/devhost and unit tests pass under LuaJIT.

Manual devhost smoke test:

luajit tools/devhost/local-ui-demo.lua 18089

Then opened:

http://127.0.0.1:18089/

and checked:

curl -fsS http://127.0.0.1:18089/api/local-ui/bootstrap
curl -fsS http://127.0.0.1:18089/api/gsm/apns/custom
curl -fsS http://127.0.0.1:18089/api/diagnostics

The demo serves the fallback UI, returns a curated bootstrap model, exercises the APN route through UI → GSM → fake HAL control-store, and returns the expected diagnostics stub.

Added tests?

• 👍 yes

Added coverage includes:

• local UI route/model unit coverage;
• GSM APN validation, ranking and redaction tests;
• devhost integration coverage using real HTTP/UI/GSM services with a fake HAL control-store;
• static UI serving and SPA fallback checks;
• APN PUT/GET checks through the real HTTP path;
• bootstrap redaction checks.

Added to documentation?

• 📜 README.md

Added devhost documentation for the local UI demo under:

docs/devhost/local-ui-demo.md