Adds albedo web [workspace] [--port N] [--no-open] with a local loopback gateway and a browser canvas for root session overview, bounded preview, durable main-thread history/live turns, and child-agent status/delegation. The browser receives a single-use launch capability and HttpOnly SameSite cookie; the daemon bearer remains inside the Go gateway. Moves, sizes, pins, and archives are browser-local. This does not implement multi-daemon connectivity or a delegation-only policy.
Verified with go -C cli test ./..., go -C cli vet ./..., the uncached real-daemon TestWebCanvasRoutesRealTurnAndDelegation scenario, and real Chromium desktop/mobile interaction (composer, delegation, layout/resize, and 390px no-overflow).