feat(web): read-only dashboard app + ci web serve (W4)

src/ci_orchestrator/commands/web.py

@@ -0,0 +1,56 @@
+"""``web`` sub-commands -- ``ci web serve`` launches the dashboard app.
+
+**Import discipline (non-negotiable, see CLAUDE.md / the web-UI plan)**: this
+module imports only ``click`` and stdlib at module scope. ``fastapi``,
+``uvicorn`` and ``ci_orchestrator.web`` (which pulls in fastapi/jinja2) are
+imported lazily, inside :func:`serve`'s body -- never at import time. This
+keeps ``ci --help`` (and every other CLI command) working on a host where
+the optional ``[web]`` extra is not installed.
+"""
+
+from __future__ import annotations
+
+import click
+
+
+@click.group("web")
+def web() -> None:
+    """Web dashboard commands (read-only in this phase, no auth)."""
+
+
+@web.command("serve")
+@click.option(
+    "--host",
+    "host",
+    default=None,
+    help="Bind address (default: config web.bind_host, normally 127.0.0.1).",
+)
+@click.option(
+    "--port",
+    "port",
+    type=int,
+    default=None,
+    help="Bind port (default: config web.bind_port).",
+)
+def serve(host: str | None, port: int | None) -> None:
+    """Run the read-only web dashboard in the foreground (uvicorn).
+
+    Binds to ``127.0.0.1`` by default (never ``0.0.0.0``) -- pass ``--host``
+    explicitly (or set ``[web].bind_host`` in ``config.toml``) to expose it
+    on the LAN.
+    """
+    # Heavy imports deferred to here on purpose -- see module docstring.
+    import uvicorn
+
+    from ci_orchestrator.config import load_config
+    from ci_orchestrator.web.app import create_app
+
+    config = load_config()
+    bind_host = host if host is not None else config.web.bind_host
+    bind_port = port if port is not None else config.web.bind_port
+
+    app = create_app(config)
+    uvicorn.run(app, host=bind_host, port=bind_port)
+
+
+__all__ = ["web"]