P1 complete: web front, test suite, CI — acceptance ALL GREEN

Fan-out integration + fixes found by the test/acceptance pass:
- FIX ring-buffer: chunks >= capacity skipped bytes now count into the
  monotonic offset (invariant: stream byte k lives at k % capacity) —
  window order was corrupted on unaligned big chunks
- FIX auth: non-numeric cookie expiry no longer bypasses expiration
- FIX protocol: safe-integer validation on ack.bytes / hello.protocol
- FIX @fastify/websocket v11: websocket route must be registered in an
  encapsulated context after plugin load (handler got REST signature)
- FIX flow-control deadlock found by e2e acceptance: client only ACKs
  on data receipt, so pausing with an unACKed residue in (LOW,
  ACK_EVERY] stalled both sides at 0.9 MB. ACK_EVERY now 64 KiB (<=
  LOW invariant, tested) + trailing debounced ACK in the web client
- Web: Vue 3 + Vite + Pinia + Tailwind 4 + vue-i18n (EN/FR) + xterm 6
  (fit + webgl fallback), multiplexed ws-client with reconnect/backoff
  and resync epochs
- Tests: 100 vitest (protocol fuzz, ring edges, auth, pty-manager flow
  control with mocked pty, REST e2e) ; CI Node 22/24 + pack-smoke
- scripts/acceptance-p1.mjs: real daemon + real WS client — boot,
  login, attach, stdin, 10 MB flood w/ ACK (13.7 MB/1.9s, RSS bounded),
  brutal disconnect + replay resync, kill broadcast, SIGTERM drain

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,70 @@
+# CI Arboretum : build + tests sur Node 22/24, puis smoke de packaging npx.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Build & test (Node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [22, 24]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run build
+      - run: npx vitest run
+
+  pack-smoke:
+    name: Pack & boot smoke (Node 22)
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      # @arboretum/shared est une dépendance runtime non publiée : on packe les
+      # deux tarballs et on les installe ensemble dans un projet vierge.
+      - name: Pack tarballs
+        run: |
+          mkdir -p /tmp/tarballs
+          npm pack -w @arboretum/shared -w git-arboretum --pack-destination /tmp/tarballs
+          ls -l /tmp/tarballs
+      - name: Install tarballs in an empty project
+        run: |
+          mkdir /tmp/smoke
+          cd /tmp/smoke
+          npm init -y
+          npm i /tmp/tarballs/*.tgz
+      - name: Boot smoke (expect 401 on /api/v1/sessions)
+        run: |
+          cd /tmp/smoke
+          timeout 30 node_modules/.bin/arboretum --port 7999 --db ./t.db &
+          server_pid=$!
+          code=000
+          for i in $(seq 1 20); do
+            sleep 0.5
+            code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:7999/api/v1/sessions || true)
+            if [ "$code" = "401" ]; then break; fi
+          done
+          echo "GET /api/v1/sessions -> HTTP $code"
+          kill "$server_pid" 2>/dev/null || true
+          test "$code" = "401"