feat: add minimal web dashboard with stats, top credentials, and sessions

Implements Phase 1.5 — an embedded web UI using Go templates, Pico CSS
(dark theme), and htmx for auto-refreshing stats and active sessions.

Adds read query methods to the Store interface (GetDashboardStats,
GetTopUsernames, GetTopPasswords, GetTopIPs, GetRecentSessions) with
implementations for both SQLite and MemoryStore. Introduces the
internal/web package with server, handlers, templates, and tests.
Web server is opt-in via [web] config section and runs alongside
SSH with graceful shutdown. Bumps version to 0.2.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -40,6 +40,8 @@ Key settings:
 - `shell.hostname` — hostname shown in shell prompts (default `ubuntu-server`)
 - `shell.banner` — banner displayed on connection
 - `shell.fake_user` — override username in prompt; empty uses the authenticated user
+- `web.enabled` — enable the web dashboard (default `false`)
+- `web.listen_addr` — web dashboard listen address (default `:8080`)
 
 ### Run