feat(dashboard): GuruConnect v2 operator console (pass 1)

React + Vite + TypeScript SPA: scaffold, operations-terminal design
system, Bearer-token auth, and the Machines view.

- Design system: OKLCH-tinted dark theme (ink-slate + signal-cyan),
  Hanken Grotesk + JetBrains Mono, status-color language
  (online/offline/granted/pending/denied/not_required), motion with
  prefers-reduced-motion honored.
- Auth: token in sessionStorage via ref (never React state), protected
  routes, 401 session teardown, admin-gated per-agent-key UI.
- Machines view: data table (sticky header, keyboard-activated rows,
  skeleton loading, actionable empty/error states), non-blocking detail
  drawer, delete confirm, admin key management with copy-once reveal.
- UI primitives: Modal (focus trap + inert + portal + dialogStack),
  Drawer, Table, Badge/StatusDot, toast, states.
- Typed API client normalizing the two error-envelope shapes.

Passed Code Review (no blockers), impeccable critique-and-polish, and
local gates (tsc/lint/build green). Dev-only Vite proxy to :3002.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

dashboard/src/api/stubs.ts

@@ -0,0 +1,23 @@
+// Scaffolds for later passes. These endpoints exist on the server but their
+// views (Sessions, Codes, Users) are out of scope for pass 1. Typed signatures
+// are stubbed here so the API surface is discoverable and future passes can
+// flesh out the response interfaces against the Rust source.
+//
+// Intentionally minimal: do NOT build UI against these yet.
+
+import { http } from "./client";
+
+/** GET /api/sessions — active/historical sessions. Pass 2. */
+export function listSessions(signal?: AbortSignal): Promise<unknown[]> {
+  return http.get<unknown[]>("/api/sessions", signal);
+}
+
+/** GET /api/codes — one-time support codes. Pass 2. */
+export function listCodes(signal?: AbortSignal): Promise<unknown[]> {
+  return http.get<unknown[]>("/api/codes", signal);
+}
+
+/** GET /api/users — dashboard users (admin). Pass 2. */
+export function listUsers(signal?: AbortSignal): Promise<unknown[]> {
+  return http.get<unknown[]>("/api/users", signal);
+}