Embedded HTTP server for the forgetop web dashboard.
It's a thin frontend over the same SectionService / health services the TUI uses —
no logic fork. Wave 1 is a read-only JSON API + a placeholder page, bound to 127.0.0.1
and gated by a per-session token so no other local process or web page can reach it.