feat(webui): add browser terminal interface via ttyd

Adds a webui service to docker-compose that wraps Claude Code in ttyd,
serving a browser-accessible terminal on port 7681. The webui reuses
Dockerfile.claude (ttyd added to apt deps) with a dedicated entrypoint
script that enforces WEBUI_PASSWORD before starting. Network isolation
is identical to the CLI container: claude-internal only, all egress via
the proxy allowlist. claude.sh gains web and web-stop commands.

Dockerfile.claude

@@ -6,8 +6,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         curl \
         ca-certificates \
         bash \
+        ttyd \
     && rm -rf /var/lib/apt/lists/*
 
+# Entrypoint used by the webui service (ttyd wrapping claude)
+COPY --chmod=755 webui-entrypoint.sh /usr/local/bin/webui-entrypoint.sh
+
 # Create non-root user
 RUN groupadd -g 1000 claude \
     && useradd -u 1000 -g claude -m -s /bin/bash claude