feat: add Mira workflow console read-only MVP

[mira-zennai]

Summary

• Add read-only Mira workflow indexing from MiraRepo docs/workflows/definitions, runbooks, reports, and Hermes cron metadata.
• Add authenticated /api/workflows and /api/workflows/:id endpoints.
• Add a Workflows tab with summary cards, inventory table, status/warning display, and raw definition/runbook/report preview modal.
• Add node:test coverage for workflow indexing, detail loading, and stale delivery-warning classification.
• Make cron lookup LaunchAgent-safe by using direct Hermes CLI execution instead of shell timeout / PATH-dependent lookup on macOS.
• Synced with upstream main / v3.5.1 and resolved the server.js conflict.

Safety notes

• Read-only MVP: no cron create/update/pause/resume, no file writes, no external posting.
• Auth is required for workflow API endpoints.
• Secrets are not parsed or displayed beyond the existing repo files selected by workflow definitions.
• MiraRepo path can be overridden with MIRA_REPO_DIR; defaults to local MiraRepo worktree candidates.

Verification

• npm test — passed, 14/14 tests.
• npm run build — passed.
• git diff --check — passed.
• Local LaunchAgent smoke test at http://127.0.0.1:10272:
  • login API returned ok for existing admin session.
  • /api/workflows returned 3 workflows.
  • summary returned ok=1, stale_warning=1, missing_cron=1, active_failure=0.
  • /api/workflows/weekly-memory-refactor linked cron id d27468bad831, deliver local, and showed the expected stale delivery warning.
• GitHub reports this PR as mergeable after upstream sync.

Related: ZennAI-Japan/MiraRepo#42