P1 complete: web front, test suite, CI — acceptance ALL GREEN

Fan-out integration + fixes found by the test/acceptance pass:
- FIX ring-buffer: chunks >= capacity skipped bytes now count into the
  monotonic offset (invariant: stream byte k lives at k % capacity) —
  window order was corrupted on unaligned big chunks
- FIX auth: non-numeric cookie expiry no longer bypasses expiration
- FIX protocol: safe-integer validation on ack.bytes / hello.protocol
- FIX @fastify/websocket v11: websocket route must be registered in an
  encapsulated context after plugin load (handler got REST signature)
- FIX flow-control deadlock found by e2e acceptance: client only ACKs
  on data receipt, so pausing with an unACKed residue in (LOW,
  ACK_EVERY] stalled both sides at 0.9 MB. ACK_EVERY now 64 KiB (<=
  LOW invariant, tested) + trailing debounced ACK in the web client
- Web: Vue 3 + Vite + Pinia + Tailwind 4 + vue-i18n (EN/FR) + xterm 6
  (fit + webgl fallback), multiplexed ws-client with reconnect/backoff
  and resync epochs
- Tests: 100 vitest (protocol fuzz, ring edges, auth, pty-manager flow
  control with mocked pty, REST e2e) ; CI Node 22/24 + pack-smoke
- scripts/acceptance-p1.mjs: real daemon + real WS client — boot,
  login, attach, stdin, 10 MB flood w/ ACK (13.7 MB/1.9s, RSS bounded),
  brutal disconnect + replay resync, kill broadcast, SIGTERM drain

packages/web/src/stores/auth.ts

@@ -0,0 +1,42 @@
+import { defineStore } from 'pinia';
+import { ref } from 'vue';
+import type { LoginResponse, MeResponse } from '@arboretum/shared';
+import { api } from '../lib/api';
+import { wsClient } from '../lib/ws-client';
+
+export const useAuthStore = defineStore('auth', () => {
+  /** null = pas encore vérifié auprès du serveur */
+  const authenticated = ref<boolean | null>(null);
+  const tokenLabel = ref<string | null>(null);
+  const serverVersion = ref<string | null>(null);
+
+  async function check(): Promise<boolean> {
+    try {
+      const me = await api.get<MeResponse>('/api/v1/auth/me');
+      tokenLabel.value = me.tokenLabel;
+      serverVersion.value = me.serverVersion;
+      authenticated.value = true;
+    } catch {
+      authenticated.value = false;
+    }
+    return authenticated.value === true;
+  }
+
+  async function login(token: string): Promise<void> {
+    const res = await api.post<LoginResponse>('/api/v1/auth/login', { token });
+    tokenLabel.value = res.label;
+    authenticated.value = true;
+  }
+
+  async function logout(): Promise<void> {
+    try {
+      await api.post<{ ok: true }>('/api/v1/auth/logout');
+    } finally {
+      wsClient.disconnect();
+      authenticated.value = false;
+      tokenLabel.value = null;
+    }
+  }
+
+  return { authenticated, tokenLabel, serverVersion, check, login, logout };
+});

packages/web/src/stores/sessions.ts

@@ -0,0 +1,76 @@
+import { defineStore } from 'pinia';
+import { ref } from 'vue';
+import type { CreateSessionRequest, SessionResponse, SessionSummary, SessionsListResponse } from '@arboretum/shared';
+import { api } from '../lib/api';
+import { wsClient, type SessionEvent } from '../lib/ws-client';
+
+export const useSessionsStore = defineStore('sessions', () => {
+  const sessions = ref<SessionSummary[]>([]);
+  const loading = ref(false);
+  const loadError = ref<string | null>(null);
+  let unsubscribe: (() => void) | null = null;
+
+  // vivantes d'abord, puis par date de création décroissante (même ordre que le serveur)
+  function sorted(list: SessionSummary[]): SessionSummary[] {
+    return [...list].sort((a, b) => Number(b.live) - Number(a.live) || b.createdAt.localeCompare(a.createdAt));
+  }
+
+  function upsert(session: SessionSummary): void {
+    const idx = sessions.value.findIndex((s) => s.id === session.id);
+    if (idx >= 0) sessions.value.splice(idx, 1, session);
+    else sessions.value.push(session);
+    sessions.value = sorted(sessions.value);
+  }
+
+  function onEvent(e: SessionEvent): void {
+    if (e.type === 'session_update') {
+      upsert(e.session);
+      return;
+    }
+    const current = sessions.value.find((s) => s.id === e.sessionId);
+    if (!current) return;
+    upsert({
+      ...current,
+      status: 'exited',
+      live: false,
+      exitCode: e.exitCode,
+      endedAt: new Date().toISOString(),
+      clients: 0,
+    });
+  }
+
+  async function fetchSessions(): Promise<void> {
+    loading.value = true;
+    loadError.value = null;
+    try {
+      const res = await api.get<SessionsListResponse>('/api/v1/sessions');
+      sessions.value = sorted(res.sessions);
+    } catch (err) {
+      loadError.value = err instanceof Error ? err.message : String(err);
+    } finally {
+      loading.value = false;
+    }
+  }
+
+  function startRealtime(): void {
+    unsubscribe ??= wsClient.subscribeSessions(onEvent);
+  }
+
+  function stopRealtime(): void {
+    unsubscribe?.();
+    unsubscribe = null;
+  }
+
+  async function createSession(cwd: string, command: NonNullable<CreateSessionRequest['command']>): Promise<SessionSummary> {
+    const body: CreateSessionRequest = { cwd, command };
+    const res = await api.post<SessionResponse>('/api/v1/sessions', body);
+    upsert(res.session);
+    return res.session;
+  }
+
+  async function killSession(id: string): Promise<void> {
+    await api.delete<{ ok: true }>(`/api/v1/sessions/${id}`);
+  }
+
+  return { sessions, loading, loadError, fetchSessions, startRealtime, stopRealtime, createSession, killSession };
+});