[Epic] v0.18 built-in UI (conduit-ui): observe + operate

Design doc: `docs/design-documents/20260713-greenfield-built-in-ui.md` (#2623).

Greenfield React UI in a new `conduit-ui` repo, embedded via `go:embed` and served by `conduit run`. Scope: **observe + operate**, NOT authoring (config-as-code stays the single source of truth).

## Prerequisite API PRs on `conduit` (land before the matching UI slice; mostly parallel)
- [ ] **P1** Inspect drop-metric — expose dropped-record count/rate (Inspector drops-on-full silently today) → gates the live-flow drop indicator
- [ ] **P2** Configurable CORS allowlist (replace hardcoded `localhost:4200`) → gates remote-engine + dev-mode; **wanted early**
- [ ] **P3** `stopReason`/`stopped_by` additive field on pipeline state → gates fleet-view "operator-stopped vs engine-restarted" accuracy
- [ ] **P4** `pause` — **design doc first** (quiesce/ack semantics, invariant 7), then verb. Off the UI critical path
- [ ] **P5** Pipeline-scoped `repair` API + `Pipeline`→`PipelineDocument` export — **design doc first** (changes a public contract). Off the critical path
- [ ] **P6** DLQ-record read API (last-N + cause) **or** explicit v0.18 descope of DLQ visibility
- [ ] **P7** `ListPipelines` pagination — only if unfiltered p95 at 500+ pipelines is unacceptable

## UI epic (`conduit-ui` + embed)
- [ ] **UI-1** Bootstrap: repo, React+TS, CI, **generated OpenAPI client + contract test** (Inspect endpoints excluded from generation, shape-asserted), shared **design tokens** (with the registry UI). *Gates UI-2..7*
- [ ] **UI-2** Fleet view (health-first: degraded/recovering above the fold, status count header, error in ≤2 clicks). *Full accuracy needs P3*
- [ ] **UI-3** Pipeline detail + graph (4 wire status values 1:1; 200+-node graph interactive, problem nodes force-expanded; keyboard/SR linear equivalent)
- [ ] **UI-4** Live record flow + **per-stage before/after diff** (freeze-first; drawer; filtering; drop-rate from P1)
- [ ] **UI-5** Metrics + node-level lag/backpressure (healthy-idle vs stalled)
- [ ] **UI-6** Operate: **start/stop** (existing RPCs; stop confirms; bounded optimistic window; multi-actor reconciliation; no-auth banner)
- [ ] **UI-7** Embed + serve at `/` (mux-ordered after `/v1`,`/openapi`,`/healthz`,`/readyz`,metrics + collision test), disable mechanism + binary-size documented, WCAG AA + live-table/graph a11y

Acceptance criteria are per-slice in the design doc (§ Epic / PR plan), written to be user-testable.

**Parallelization:** P1/P2/P3 run in parallel with UI-1 (different repos). After UI-1, UI-2..6 are largely independent React slices. UI-7 is last (embeds the others). P4/P5/P6 are design-doc-gated and off the critical path — repair-diff-apply and DLQ view descope cleanly if they slip. The UI is the release's critical path.

Read docs/design-documents/20260713-greenfield-built-in-ui.md and its Epic / PR plan first. Then inspect the existing start/stop RPCs and the /v1, /openapi, /healthz, /readyz, and metrics serving paths before choosing a UI-1..7 slice. Done means the selected slice meets its design-doc acceptance criteria; the full epic also requires the listed API prerequisites and embedded / route.

Written by the indexing model from the issue text.