feat: add minimal web dashboard with stats, top credentials, and sessions

Implements Phase 1.5 — an embedded web UI using Go templates, Pico CSS
(dark theme), and htmx for auto-refreshing stats and active sessions.

Adds read query methods to the Store interface (GetDashboardStats,
GetTopUsernames, GetTopPasswords, GetTopIPs, GetRecentSessions) with
implementations for both SQLite and MemoryStore. Introduces the
internal/web package with server, handlers, templates, and tests.
Web server is opt-in via [web] config section and runs alongside
SSH with graceful shutdown. Bumps version to 0.2.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/web/templates/dashboard.html

@@ -0,0 +1,93 @@
+{{define "content"}}
+<section id="stats-section" hx-get="/fragments/stats" hx-trigger="every 30s" hx-swap="innerHTML">
+    {{template "stats" .Stats}}
+</section>
+
+<section>
+    <h3>Top Credentials & IPs</h3>
+    <div class="top-grid">
+        <article>
+            <header>Top Usernames</header>
+            <table>
+                <thead>
+                    <tr><th>Username</th><th>Attempts</th></tr>
+                </thead>
+                <tbody>
+                    {{range .TopUsernames}}
+                    <tr><td>{{.Value}}</td><td>{{.Count}}</td></tr>
+                    {{else}}
+                    <tr><td colspan="2">No data</td></tr>
+                    {{end}}
+                </tbody>
+            </table>
+        </article>
+        <article>
+            <header>Top Passwords</header>
+            <table>
+                <thead>
+                    <tr><th>Password</th><th>Attempts</th></tr>
+                </thead>
+                <tbody>
+                    {{range .TopPasswords}}
+                    <tr><td>{{.Value}}</td><td>{{.Count}}</td></tr>
+                    {{else}}
+                    <tr><td colspan="2">No data</td></tr>
+                    {{end}}
+                </tbody>
+            </table>
+        </article>
+        <article>
+            <header>Top IPs</header>
+            <table>
+                <thead>
+                    <tr><th>IP</th><th>Attempts</th></tr>
+                </thead>
+                <tbody>
+                    {{range .TopIPs}}
+                    <tr><td>{{.Value}}</td><td>{{.Count}}</td></tr>
+                    {{else}}
+                    <tr><td colspan="2">No data</td></tr>
+                    {{end}}
+                </tbody>
+            </table>
+        </article>
+    </div>
+</section>
+
+<section>
+    <h3>Active Sessions</h3>
+    <div id="active-sessions" hx-get="/fragments/active-sessions" hx-trigger="every 10s" hx-swap="innerHTML">
+        {{template "active_sessions" .ActiveSessions}}
+    </div>
+</section>
+
+<section>
+    <h3>Recent Sessions</h3>
+    <table>
+        <thead>
+            <tr>
+                <th>ID</th>
+                <th>IP</th>
+                <th>Username</th>
+                <th>Shell</th>
+                <th>Connected</th>
+                <th>Disconnected</th>
+            </tr>
+        </thead>
+        <tbody>
+            {{range .RecentSessions}}
+            <tr>
+                <td><code>{{truncateID .ID}}</code></td>
+                <td>{{.IP}}</td>
+                <td>{{.Username}}</td>
+                <td>{{.ShellName}}</td>
+                <td>{{formatTime .ConnectedAt}}</td>
+                <td>{{if .DisconnectedAt}}{{formatTime (derefTime .DisconnectedAt)}}{{else}}<mark>active</mark>{{end}}</td>
+            </tr>
+            {{else}}
+            <tr><td colspan="6">No sessions</td></tr>
+            {{end}}
+        </tbody>
+    </table>
+</section>
+{{end}}