feat: add web terminal UI with WebSocket console and clone management API

Introduces a browser-based terminal interface backed by xterm.js, served
directly from the binary via an embedded HTML asset.

New HTTP server (`serve [addr]`, default :8080):
  GET  /              — xterm.js terminal UI; ?id=N selects a clone
  GET  /clones        — JSON list of running clone IDs
  POST /clones        — spawn a new clone; returns {"id": N}
  DELETE /clones/{id} — destroy a clone by ID
  GET  /ws/{id}       — WebSocket console for clone {id}
                        binary frames = raw PTY I/O
                        text frames   = JSON resize {"rows":N,"cols":M}

Supporting changes:
- orchestrator: add SpawnSingle() and KillClone(id) for per-clone lifecycle
  management from the HTTP layer
- console: add a resize sideband Unix socket (console-resize.sock) that
  accepts newline-delimited JSON {"rows","cols"} messages and applies them
  to the PTY master via pty.Setsize; the WebSocket handler writes to this
  socket on text frames so browser window resizes propagate into the VM
- deps: add gorilla/websocket v1.5.3

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

main.go

@@ -80,6 +80,12 @@ func main() {
 		fatal(orch.Kill())
 	case "cleanup":
 		fatal(orch.Cleanup())
+	case "serve":
+		addr := ":8080"
+		if len(os.Args) > 2 {
+			addr = os.Args[2]
+		}
+		fatal(orchestrator.Serve(orch, addr))
 	case "console":
 		if len(os.Args) < 3 {
 			fmt.Fprintf(os.Stderr, "usage: %s console <id>\n", os.Args[0])
@@ -116,6 +122,7 @@ Commands:
   init          Download kernel + create Alpine rootfs
   golden        Boot golden VM → pause → snapshot
   spawn [N]     Restore N clones from golden snapshot (default: 1)
+  serve [addr]  Start terminal web UI (default: :8080)
   console <id>  Attach to the serial console of a running clone (Ctrl+] to detach)
   status        Show running clones
   kill          Kill all running VMs