feat: add minimal web dashboard with stats, top credentials, and sessions

Implements Phase 1.5 — an embedded web UI using Go templates, Pico CSS
(dark theme), and htmx for auto-refreshing stats and active sessions.

Adds read query methods to the Store interface (GetDashboardStats,
GetTopUsernames, GetTopPasswords, GetTopIPs, GetRecentSessions) with
implementations for both SQLite and MemoryStore. Introduces the
internal/web package with server, handlers, templates, and tests.
Web server is opt-in via [web] config section and runs alongside
SSH with graceful shutdown. Bumps version to 0.2.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -13,10 +13,16 @@ type Config struct {
 	Auth      AuthConfig     `toml:"auth"`
 	Storage   StorageConfig  `toml:"storage"`
 	Shell     ShellConfig    `toml:"shell"`
+	Web       WebConfig      `toml:"web"`
 	LogLevel  string         `toml:"log_level"`
 	LogFormat string         `toml:"log_format"` // "text" (default) or "json"
 }
 
+type WebConfig struct {
+	Enabled    bool   `toml:"enabled"`
+	ListenAddr string `toml:"listen_addr"`
+}
+
 type ShellConfig struct {
 	Hostname string                    `toml:"hostname"`
 	Banner   string                    `toml:"banner"`
@@ -112,6 +118,9 @@ func applyDefaults(cfg *Config) {
 	if cfg.Storage.RetentionInterval == "" {
 		cfg.Storage.RetentionInterval = "1h"
 	}
+	if cfg.Web.ListenAddr == "" {
+		cfg.Web.ListenAddr = ":8080"
+	}
 	if cfg.Shell.Hostname == "" {
 		cfg.Shell.Hostname = "ubuntu-server"
 	}