feat(dashboard): scaffold SvelteKit SPA for control plane

SvelteKit 2 + Svelte 5 (runes) + TS, built with `adapter-static`
into a single SPA bundle that Caddy serves verbatim in production.
The dashboard targets only `/api/admin/*` (manager); data-plane
invocations go through the orchestrator, not through here.

  * Vite dev server proxies `/api` and `/healthz` to PICLOUD_API
    (default `http://127.0.0.1:18080` to match the picloud bind
    override). Port configurable via PICLOUD_DASHBOARD_PORT.
  * `src/lib/api.ts` is a thin typed client over the control-plane
    paths; the scripts placeholder route shows the "load → error →
    list" shape so the missing-API state is informative, not blank.
  * SSR disabled at the layout level: the build is a pure SPA, no
    Node runtime is required at serve time.
  * `npm run check` and `npm run build` both green; `npm audit`
    clean (cookie override pins past the SvelteKit transitive
    advisory that doesn't apply in SPA mode).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashboard/README.md

@@ -0,0 +1,32 @@
+# PiCloud Dashboard
+
+SvelteKit SPA for the PiCloud control plane.
+
+## Stack
+
+- SvelteKit 2 with `adapter-static` (SPA fallback)
+- Svelte 5 (runes)
+- TypeScript
+- Vite
+
+## Scripts
+
+```sh
+npm install
+npm run dev      # vite dev server on :5173, proxies /api → PICLOUD_API
+npm run build    # static SPA bundle into ./build/
+npm run check    # svelte-check
+npm run lint
+npm run format
+```
+
+By default `npm run dev` proxies `/api/*` and `/healthz` to
+`http://127.0.0.1:18080`. Override with `PICLOUD_API=http://host:port npm run dev`.
+
+## How it fits in
+
+In production Caddy serves the contents of `./build/` as static files and
+falls back to `index.html` for client-side routing. The dashboard only
+talks to the **control plane** (`/api/admin/*` on the manager); data-plane
+invocations go through `/api/execute/*` on the orchestrator and are not
+issued from the dashboard directly during MVP.