Add multi-user web server variant (browser UI behind a reverse proxy)

New web/ subfolder: a Node http server that serves the SAME tooling as the
Electron app to any browser, with per-session MCMS credentials so several
operators can use it at once behind a TLS reverse proxy. Mobile-responsive.

Not a fork — it reuses the core and the UI:
- serves renderer/app.js + app.css verbatim and rewrites index.html on the
  fly (mobile viewport + browser window.api shim + responsive overlay)
- web/public/api-web.js: a drop-in window.api over fetch + NDJSON streaming;
  Electron file dialogs -> <input type=file>, CSV-to-Downloads -> Blob
- web/server.js: per-session McmsClient (cookie pfw_sid), idle expiry,
  routes mirroring the IPC handlers, NDJSON for the 6 streaming ops
- pure Node http, no new deps (borrows ../node_modules tough-cookie)

Shared improvements (benefit both apps):
- src/dashboard.js: extracted, pure dashboard aggregation (main.js now uses
  it); adds abnormal-Tx detection alongside abnormal-Rx
- renderer: dashboard health stats are now clickable — abnormal Rx / Tx /
  lasers-off pop a list of the offending devices (like the iOS app), via a
  new showListModal

Docs: web/README.md (run + reverse-proxy + security), CLAUDE.md §16.

Verified: node --check all; started the server and confirmed transformed
index, shared-asset serving, 401 auth gate, login (per-session client), and
NDJSON wiring; rendered login + dashboard drilldown + mobile over HTTP.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -774,4 +774,32 @@ Respects `prefers-reduced-motion`. z-index sits below the scanline overlay
 
 ---
 
+## 16. Web server variant (`web/`)
+
+A multi-user, browser-based deployment of the *same* tooling lives in
+`web/` — see `web/README.md`. It is **not a fork**: it reuses `src/*` and
+serves `renderer/app.js` + `renderer/app.css` verbatim, rewriting
+`renderer/index.html` on the fly to swap in a browser `window.api` shim
+(`web/public/api-web.js`) and a responsive overlay (`web/public/web.css`).
+
+Consequences for editing:
+
+- **The renderer is shared.** Changes to `renderer/*` and `src/*` flow to
+  both the Electron app and the web app automatically. Keep `app.js`
+  free of Electron/Node globals (it already only touches `window.api` +
+  DOM) so the shim stays sufficient.
+- **`window.api` is the contract.** If you add an IPC channel (see §10),
+  also add it to `web/server.js` (a route) **and** `web/public/api-web.js`
+  (the shim method) or the web app won't have it. Streaming channels use
+  NDJSON (progress lines + a `{__final:…}` line) instead of IPC events.
+- **Per-session isolation.** `web/server.js` keeps one `McmsClient` per
+  browser session (cookie `pfw_sid`), vs. the Electron app's single global
+  `client`. CSV writes become browser downloads; file dialogs become
+  `<input type=file>`. Dashboard aggregation is shared via `src/dashboard.js`.
+
+The web app must stay a subdirectory of this repo — it `require`s `../src/*`
+and borrows `../node_modules` (`tough-cookie`); no separate install.
+
+---
+
 *Last updated: 2026-06-23.*