feat(webui): add browser terminal interface via ttyd

Adds a webui service to docker-compose that wraps Claude Code in ttyd,
serving a browser-accessible terminal on port 7681. The webui reuses
Dockerfile.claude (ttyd added to apt deps) with a dedicated entrypoint
script that enforces WEBUI_PASSWORD before starting. Network isolation
is identical to the CLI container: claude-internal only, all egress via
the proxy allowlist. claude.sh gains web and web-stop commands.

webui-entrypoint.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Entrypoint for the webui service.
+# Wraps Claude Code in ttyd (terminal-over-WebSocket) with basic auth.
+set -euo pipefail
+
+: "${WEBUI_PASSWORD:?WEBUI_PASSWORD must be set in .env}"
+WEBUI_USER="${WEBUI_USER:-claude}"
+WEBUI_PORT="${WEBUI_PORT:-7681}"
+
+exec ttyd \
+    --port "${WEBUI_PORT}" \
+    --writable \
+    --credential "${WEBUI_USER}:${WEBUI_PASSWORD}" \
+    claude