feat(ADR-131): HOMECORE-UI operational dashboard + BFF gateway

Complete two-tier Cognitum operator dashboard (ADR-131), served by
homecore-server at /homecore, plus the single-origin BFF gateway that
wires it to real backends.

Front-end (zero-dep vanilla TS/JS + CSS, exact Cognitum design tokens):
- All 10 panels (§4.1-4.10): dashboard, SEED fleet + detail, fleet map,
  entities (live WS subscribe_events, never polls), rooms, COGs,
  calibration wizard, events + automation builder, witness/audit, settings.
- §6 UX invariants in code: first-class provenance, prominent stale/veto/
  fragility, null(not-trained) vs withheld vs error, --mono everywhere,
  Hailo vs CPU COG distinction.
- api.js calls the gateway routes in production; mock demoted to a
  dev-only ?demo=1 fixture (no mock in prod); typed error states.
- Tests under plain node: import-graph, boot, render-smoke (22),
  interaction (3), prod-errors (13) — 5 files green; bundle ~137 KB
  (~37x smaller than HA), <2 ms/cold-render.

BFF gateway (homecore-server/src/gateway.rs, compiled + tested on Rust 1.89):
- /api/cal/* reverse-proxy to the calibration API (ADR-151).
- GET /api/homecore/rooms with the RoomState adapter (breathing->breathing_bpm,
  heartbeat:null->heart_bpm:null, injected anomaly.threshold/room_id).
- GET /api/homecore/cogs supervisor over /var/lib/cognitum/apps/.
- GET /api/homecore/appliance from /proc + TCP service probes.
- SEED-device/appliance routes return typed 503 upstream_unavailable.
- cargo test -p homecore-server = 12/12; run live (curl-verified);
  fixed a real double-v1 proxy-URL bug found during live testing.

Honest scope: W1/W2/W4/W6-appliance functional; W3/W5/W6-Hailo/federation
return typed 503 (depend on services/hardware not in this repo).

Co-Authored-By: claude-flow <ruv@ruv.net>

v2/crates/homecore-server/ui/tests/boot.mjs

@@ -0,0 +1,37 @@
+// Boot regression test — exercises the REAL app.js boot + router (not
+// just individual panels). Catches the class of bug where start() throws
+// before route() runs and the dashboard renders blank.
+// Run: node tests/boot.mjs   (from the ui/ dir)
+import { install } from './dom-shim.mjs';
+const { document, window } = install();
+globalThis.HOMECORE_UI_DEMO = true; // boot with fixtures (no gateway in tests)
+
+const errs = [];
+const origErr = console.error;
+console.error = (...a) => { errs.push(a.map(String).join(' ')); };
+
+await import('../js/app.js');
+await new Promise((r) => setTimeout(r, 30));
+console.error = origErr;
+
+const fails = [];
+const content = document.getElementById('hc-content');
+const app = document.getElementById('app');
+
+if (!app || app.children.length < 2) fails.push('shell not built (#app should have topnav + shell)');
+if (!content) fails.push('#hc-content missing — buildShell did not run');
+else if (content.children.length === 0) fails.push('BLANK: dashboard rendered nothing into #hc-content on boot');
+if (errs.length) fails.push('console.error during boot: ' + errs.slice(0, 3).join(' | '));
+
+// navigation must re-render the panel
+window.location.hash = '#/fleet';
+await new Promise((r) => setTimeout(r, 30));
+if (!content || content.children.length === 0) fails.push('BLANK after navigating to #/fleet');
+
+// a clean topnav with no dead Cognitum tabs / Cog Store link
+const links = app ? app.querySelectorAll('a') : [];
+const hrefs = links.map((a) => a.getAttribute('href') || '');
+if (hrefs.some((h) => /cognitum\.one\/store/.test(h))) fails.push('Cog Store external link should be removed');
+
+if (fails.length) { console.error('\nFAILED:'); fails.forEach((f) => console.error('  ✗ ' + f)); process.exit(1); }
+console.log('OK — app.js boots, dashboard renders, navigation re-renders, no dead Cog Store link');