feat(dashboard): scaffold SvelteKit SPA for control plane

SvelteKit 2 + Svelte 5 (runes) + TS, built with `adapter-static`
into a single SPA bundle that Caddy serves verbatim in production.
The dashboard targets only `/api/admin/*` (manager); data-plane
invocations go through the orchestrator, not through here.

  * Vite dev server proxies `/api` and `/healthz` to PICLOUD_API
    (default `http://127.0.0.1:18080` to match the picloud bind
    override). Port configurable via PICLOUD_DASHBOARD_PORT.
  * `src/lib/api.ts` is a thin typed client over the control-plane
    paths; the scripts placeholder route shows the "load → error →
    list" shape so the missing-API state is informative, not blank.
  * SSR disabled at the layout level: the build is a pure SPA, no
    Node runtime is required at serve time.
  * `npm run check` and `npm run build` both green; `npm audit`
    clean (cookie override pins past the SvelteKit transitive
    advisory that doesn't apply in SPA mode).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashboard/vite.config.ts

@@ -0,0 +1,20 @@
+import { sveltekit } from '@sveltejs/kit/vite';
+import { defineConfig } from 'vite';
+
+// Dev-only proxy: in production Caddy fronts both the dashboard and the
+// API. During `vite dev` we proxy the API ourselves so the dashboard can
+// run standalone against a locally-running `picloud` binary.
+const API_TARGET = process.env.PICLOUD_API ?? 'http://127.0.0.1:18080';
+const DEV_PORT = Number(process.env.PICLOUD_DASHBOARD_PORT ?? 5173);
+
+export default defineConfig({
+	plugins: [sveltekit()],
+	server: {
+		port: DEV_PORT,
+		strictPort: true,
+		proxy: {
+			'/api': { target: API_TARGET, changeOrigin: true },
+			'/healthz': { target: API_TARGET, changeOrigin: true }
+		}
+	}
+});