feat: UI vue Review + backend sert le SPA, fin Phase 4 v1 (v0.24.0)

Vue Review (liste assets, approuver/refuser + confirm, refresh, 401→logout).
Backend sert le SPA same-origin (@fastify/static + fallback) si CHLOVA_WEB_ROOT.
Dockerfile multi-stage build web+API (contexte racine), image embarque /app/web.
Compose contexte .., image chlova/backend:0.2.0. 65 tests, 0 vuln, compose OK.

Palier de risque : privilégié (surface exposée complète) — non déployée ;
auth + CHLOVA_PHASE requis pour activer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

orchestrator/package.json

@@ -19,6 +19,7 @@
   "dependencies": {
     "@fastify/cors": "11.2.0",
     "@fastify/rate-limit": "11.0.0",
+    "@fastify/static": "9.1.3",
     "@modelcontextprotocol/sdk": "1.29.0",
     "fastify": "5.8.5",
     "jose": "6.2.3",