feat: add runbook studio dashboard and universal palette

[darwvin-dev]

Scope

• Runbook Studio with bounded YAML import/export, schema validation, server-side variable rendering, unresolved-variable detection, destructive-step markers and true dry-run preview
• partial runbook retry from the first failed step while preserving confirmation boundaries
• live operations dashboard backed by persisted health history, alerts, tunnel state, recent runbooks and multi-host runs
• Command Palette 2.0 indexing application actions, protocol-specific server actions, health/diagnostics, runbooks and snippets
• snippet execution requires a focused server and explicit confirmation; production targets are clearly called out
• responsive experience styling for dashboard, Studio and palette

Stacked PR

This PR is intentionally based on agent/operator-data-plane until PR #29 is merged, then it will be retargeted to main before final merge.

Merge gate

No one-shot helper workflow may remain in the final diff. Merge only after the exact head passes title, frontend build/tests, security gates, rustfmt, Rust tests/build and the inherited live-SSH Linux fixture.

[darwvin-dev]

Superseded by #31. The replacement branch was rebuilt directly on the hardened operator-data-plane head so the experience work cannot revert phase-2 security/reliability fixes. #31 also closes the missing wiring, universal-palette, server-authoritative runbook preparation, destructive-variable confirmation, styling import, and multi-host cancellation gaps found during audit.