P1 complete: web front, test suite, CI — acceptance ALL GREEN

Fan-out integration + fixes found by the test/acceptance pass:
- FIX ring-buffer: chunks >= capacity skipped bytes now count into the
  monotonic offset (invariant: stream byte k lives at k % capacity) —
  window order was corrupted on unaligned big chunks
- FIX auth: non-numeric cookie expiry no longer bypasses expiration
- FIX protocol: safe-integer validation on ack.bytes / hello.protocol
- FIX @fastify/websocket v11: websocket route must be registered in an
  encapsulated context after plugin load (handler got REST signature)
- FIX flow-control deadlock found by e2e acceptance: client only ACKs
  on data receipt, so pausing with an unACKed residue in (LOW,
  ACK_EVERY] stalled both sides at 0.9 MB. ACK_EVERY now 64 KiB (<=
  LOW invariant, tested) + trailing debounced ACK in the web client
- Web: Vue 3 + Vite + Pinia + Tailwind 4 + vue-i18n (EN/FR) + xterm 6
  (fit + webgl fallback), multiplexed ws-client with reconnect/backoff
  and resync epochs
- Tests: 100 vitest (protocol fuzz, ring edges, auth, pty-manager flow
  control with mocked pty, REST e2e) ; CI Node 22/24 + pack-smoke
- scripts/acceptance-p1.mjs: real daemon + real WS client — boot,
  login, attach, stdin, 10 MB flood w/ ACK (13.7 MB/1.9s, RSS bounded),
  brutal disconnect + replay resync, kill broadcast, SIGTERM drain

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/web/src/stores/auth.ts

@@ -0,0 +1,42 @@
+import { defineStore } from 'pinia';
+import { ref } from 'vue';
+import type { LoginResponse, MeResponse } from '@arboretum/shared';
+import { api } from '../lib/api';
+import { wsClient } from '../lib/ws-client';
+
+export const useAuthStore = defineStore('auth', () => {
+  /** null = pas encore vérifié auprès du serveur */
+  const authenticated = ref<boolean | null>(null);
+  const tokenLabel = ref<string | null>(null);
+  const serverVersion = ref<string | null>(null);
+
+  async function check(): Promise<boolean> {
+    try {
+      const me = await api.get<MeResponse>('/api/v1/auth/me');
+      tokenLabel.value = me.tokenLabel;
+      serverVersion.value = me.serverVersion;
+      authenticated.value = true;
+    } catch {
+      authenticated.value = false;
+    }
+    return authenticated.value === true;
+  }
+
+  async function login(token: string): Promise<void> {
+    const res = await api.post<LoginResponse>('/api/v1/auth/login', { token });
+    tokenLabel.value = res.label;
+    authenticated.value = true;
+  }
+
+  async function logout(): Promise<void> {
+    try {
+      await api.post<{ ok: true }>('/api/v1/auth/logout');
+    } finally {
+      wsClient.disconnect();
+      authenticated.value = false;
+      tokenLabel.value = null;
+    }
+  }
+
+  return { authenticated, tokenLabel, serverVersion, check, login, logout };
+});