feat(rate): add shared Morris UI contract

[d-sorgcodexagent]

Summary

• add the UI-neutral Morris request, capability/job/report, and presentation seam shared by Python and TypeScript
• enforce canonical tee-aware factor ordering, full authority base/resource validation, exact scientific response invariants, and deterministic target-local ranking
• harden direct IPv4-loopback Python and same-origin browser transports with strict statuses, redirect refusal, bounded bodies, UTF-8/JSON validation, stable IDs, and sanitized errors
• keep base/GUI imports functional without SciPy, FastAPI, or Uvicorn through lazy package exports
• pin one Python-verified cross-runtime request/job/presentation fixture

Verification

• 68 exact-SHA Python authority/UI/transport/runtime review tests passed
• 118 focused TypeScript Morris tests passed
• TypeScript type-check, ESLint, and Vite production build passed
• Ruff check/format and git diff-check passed
• optional-dependency import subprocess passed with SciPy/FastAPI/Uvicorn blocked
• independent adversarial review: GO on 71c771fb73143f1839449d1cf5a1f5472a55f098

Stack and scope

• exact parent: 4986b6cfe5132cd67fb7ad4b13b9a5f0208f1500 (PR feat(rate): host private Morris authority #4398)
• issue: Epic: Ensemble variation, swing quiet zones, and sensitivity attribution #4142, R13.6
• intentionally still open: PyQt widgets/workflow, React hooks/workflow, polling/cancellation orchestration, persistence/export UI, and UpstreamDrift consumer replacement

All four canonical handoff/SPEC documents are updated in the implementation commit.