feat(gateway): presence + traffic web console (MVP, mocked mesh)

[hartsock]

Summary

agent-bridle-gateway — a new workspace crate: an axum HTTP/WebSocket server that serves a self-contained two-tab operator web console, the "web UI first" cut of the LLM-flight-recorder + WebAuthn-presence plan (#214).

• Presence tab — real WebAuthn enrollment (navigator.credentials.create, user-verification required, ES256 and EdDSA offered) and a discharge/approval round-trip (navigator.credentials.get) over a WebSocket. The gateway binds the WYSIWYS Challenge via agent-bridle-core::step_up (reused, never forked), assembles the core Discharge, and relays it to a mock MeshDischargeProvider. It performs no verification itself — the gateway is untrusted for authority (§8.3); the work-box gate re-verifies against the enrolled credential.
• Traffic tab — a live LlmFlowRecord table (the iptraf-for-LLM view) fed by a deterministic mock flow source over the same WebSocket.

Vertical slice, mocked mesh (the chosen MVP shape): the browser WebAuthn ceremony and the HTTP/WS transport are real; only the agent-mesh Bus leg and the gate's verification are stubbed, so the whole operator UX is drivable end-to-end before the mesh transport (P-d), the ES256 verifier (P-e), and enrolled-credential pinning (§7.2) land.

Honesty preserved throughout (the repo's "never overclaim" rule): the console's banner states the untrusted-relay posture, and the approval screen flags that the action summary is advisory, not bound into the signature (§8.5 WYSIWYS limit).

Home decision

A new workspace member, not airship/drake-agent — the gateway hard-reuses agent-bridle-core::step_up, and a separate repo would fork that crypto surface (the drift the newt mobile doc warns against). Heavy async deps (axum/tokio) stay isolated to this crate, out of the lean core (ADR 0008); publish = false. airship deploys it later; the homelab TLS/PKI supplies the secure origin off-localhost.

Test plan

• 9 unit tests — challenge binding (reuses core), discharge assembly (well-formed / refused / malformed), single-use + generation-bump, mock-flow ordering/fidelity, enrollment count.
• 4 end-to-end tests — a real server on an ephemeral loopback port: serves the console + assets, /api/status + /api/presence/enroll/options (ES256+EdDSA/UV-required) + /api/traffic, and a full tokio-tungstenite WebSocket presence round-trip (hello + flows → simulate_request → discharge_request → assertion → discharge_result).
• Ran the live binary: serves the console (both tabs, real navigator.credentials), mesh:mocked, returns flow records.
• cargo fmt --check, cargo clippy --all-targets -D warnings, and the full pre-push matrix (workspace tests + coverage ≥75% + publish-check) all green.

To try it: cargo run -p agent-bridle-gateway → open http://localhost:8787.

Follows the plan in #214; the deferred prerequisites (P-d/P-e, §7.2 pinning, the real MeshDischargeProvider, and the §8.5 WYSIWYS binding) are documented there.

🤖 Generated with Claude Code