feat: add minimal web dashboard with stats, top credentials, and sessions

Implements Phase 1.5 — an embedded web UI using Go templates, Pico CSS
(dark theme), and htmx for auto-refreshing stats and active sessions.

Adds read query methods to the Store interface (GetDashboardStats,
GetTopUsernames, GetTopPasswords, GetTopIPs, GetRecentSessions) with
implementations for both SQLite and MemoryStore. Introduces the
internal/web package with server, handlers, templates, and tests.
Web server is opt-in via [web] config section and runs alongside
SSH with graceful shutdown. Bumps version to 0.2.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/web/web.go

@@ -0,0 +1,48 @@
+package web
+
+import (
+	"embed"
+	"html/template"
+	"log/slog"
+	"net/http"
+
+	"git.t-juice.club/torjus/oubliette/internal/storage"
+)
+
+//go:embed static/*
+var staticFS embed.FS
+
+// Server is the web dashboard HTTP server.
+type Server struct {
+	store  storage.Store
+	logger *slog.Logger
+	mux    *http.ServeMux
+	tmpl   *template.Template
+}
+
+// NewServer creates a new web Server with routes registered.
+func NewServer(store storage.Store, logger *slog.Logger) (*Server, error) {
+	tmpl, err := loadTemplates()
+	if err != nil {
+		return nil, err
+	}
+
+	s := &Server{
+		store:  store,
+		logger: logger,
+		mux:    http.NewServeMux(),
+		tmpl:   tmpl,
+	}
+
+	s.mux.Handle("GET /static/", http.FileServerFS(staticFS))
+	s.mux.HandleFunc("GET /", s.handleDashboard)
+	s.mux.HandleFunc("GET /fragments/stats", s.handleFragmentStats)
+	s.mux.HandleFunc("GET /fragments/active-sessions", s.handleFragmentActiveSessions)
+
+	return s, nil
+}
+
+// ServeHTTP delegates to the internal mux.
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	s.mux.ServeHTTP(w, r)
+}