feat(console): serve the react web console from the installed package

[plind-junior]

What changed

adds vouch console: a starlette app that serves the vendored webapp/
react SPA plus a same-origin /proxy bridge to vouch serve --transport http backends — a python port of the vite dev-proxy
(webapp/plugins/vouch-proxy.ts): loopback-guarded, reads X-Vouch-Target,
forwards /proxy/<path> to the backend, passes backend statuses through
unmasked. the built SPA is bundled into the wheel as vouch/web/console by
a conditional hatch build hook, and the release workflow now builds the
webapp before packaging and builds the wheel from the working tree so the
console rides inside it. bumped to 1.3.0 across the four version sites;
readme + changelog updated.

Why

the react console previously shipped only via the docker demo or a repo
clone + make console (vite dev server). now pip install 'vouch-kb[web]'
then vouch console serves the same console from the installed package —
no docker, no node, no clone. the bridge must run locally and same-origin:
vouch sends no cors headers and the proxy only accepts loopback clients, so
a remotely-hosted console can't reach a local backend.

What might break

nothing on an existing .vouch/. no file moves, no on-disk field changes,
no kb.* method changes — vouch console is a new CLI command, and the
only packaging change is extra static files inside the wheel (skipped
cleanly when webapp/dist isn't built, so source-only builds still
succeed). version bumps 1.2.2 → 1.3.0.

VEP

not a surface change — no kb.* method, no object-model / on-disk-layout /
audit-log change; the wheel gaining static assets is not a kb bundle-format
change. no VEP.

Tests

• make check passes locally (ruff + mypy + full pytest green on this branch)
• New behaviour has a test — tests/test_console.py: proxy forward / loopback-guard / error-passthrough, SPA fallback, console-dir resolution, and the CLI command
• CHANGELOG.md updated under ## [Unreleased]

---

note on the commit range: this branch is based on local test, which is
ahead of origin/test by the session-transcript-viewer work, so those
commits appear in this PR's range. the console change itself is the single
faa8abd commit.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d83f20f1-eb7b-43a0-9bd1-b600d4443fdf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/vouch-console

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}