feat(web): the remaining six views, an SVG curve nobody has to see, and a stream that says when it stops (#537)

[eaitbrahim]

Closes #537.

The bulk of the client port: /setup, /activity, /insights, /rules, /venues and /gates
as client views over #534's JSON API, plus the equity curve and live updates over EventSource.
With this, the browser client reaches parity on information with the rendered pages — which is
the precondition #540 (delete render.py's HTML) and #541 (delete the curses TUI) both wait on.

Parity is on the information, and the divergences are written down

Every view is judged against both the rendered pages and tests/commands/test_tui.py. Where
those disagree with each other the divergence goes into the view's docstring rather than being
reproduced — porting a bug forward because the old surface had it is not parity.

Porting found two more instances of #548's pattern (a lookup that misses, defaulted, nothing
raised), both of which the client does not inherit:

• render.py::_STEP_KIND_NOTE has three entries against StepKind's four. The missing one is
  operator_input — the kind of the real credentials step — so the rendered /setup prints an
  empty note on the step where "what may a wizard do for you" matters most.
  payload._STEP_KIND_NOTES carries all four.
• render.py::pct appends % to four values that are fractions (The browser shows the drawdown breaker 100x too small: pct() appends % to a fraction #542). payload.ratio's
  docstring names the trap; the client shows the value at the scale the CLI does.

The chart: coordinates are computed in Python

build_equity_curve returns plot coordinates, not just figures. Where a vertical axis starts is
what makes a $3 wobble look like a collapse; keel does not let a front-end decide whether a number
is bad, and the axis it is drawn against is the same delegation wearing different clothes. So the
baseline is always zero, in Python, where a test can read it.

That is checkable rather than asserted: chart.js needs no arithmetic, so the lexer scan that
guards render.js now runs over it too — proven by mutation. The curve is role="img" named by
its own <figcaption>, with the journal table beside it for the figures.

/setup keeps its gate, and its action set is unchanged

keel.commands.setup.ACTIONS is a 0-line diff, keel/web/security.py is a 0-line diff, and
nothing under /api/* answers a POST. The client lists every action keel offers, with its inputs;
the button stays on the page that holds the write token, because /api/setup ships no CSRF token
on purpose and inventing a way to hand the client one would widen the write surface. A client that
hides a button is not a gate, so nothing is hidden — only the button is elsewhere. Where a browser
client gets a write token belongs to the milestone (#540), not to this commit.

Verification

ruff, mypy and the full suite are green (4826 passed, 3 skipped). Beyond that, smoked in a real
browser against a snapshot of the live 155 MB deployment database, because this repo's history
is that unit tests missed the failures that mattered (the empty-DB 500s, the frozen-bundle cwd, the
WAL contention):

• All six views plus Status render with real data — autonomy ON, 7 live rules, 2 open BTC
  positions, subscriptions and freshness — with no console errors (one favicon 404, which PWA: manifest, icons, and a service worker that never caches /api/* #538
  covers).
• /api/events streams retry: 2000 and a tick carrying a cheap revision fingerprint, so the
  client refetches only when the database or config actually moves. No render flicker observed
  over 16 s of polling.
• The equity curve was exercised by seeding 20 synthetic closed trades into the snapshot:
  cumulative arithmetic correct, ending at +$19.45, with a per-point accessible label and a
  <figcaption> naming the range.
• Deep links and reloads work — /static/insights served directly returns the view, not a 404.
• Cross-checked field by field against keel insights summary and keel insights journal on the
  same database: same figures, same "no rule track record yet", same drawdown scale.

One difference from the CLI, confirmed deliberate and already documented at payload.py:349: the
client labels every instant UTC, while tui._human_dt renders unlabelled local time. That is
the #381 decision (local time made the activity feed show a permanently stale "today"), not a
regression.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T6yA5khYnJ2qzheArRToQ2