feat(ui): M4 — agent activity, knowledge search, audit, correlation grouping

Add three new pages completing the control-room web UI:
- Agent activity: polls /agent-activity every 5s, filterable by type/agent
- Knowledge search: FTS over /knowledge/search with snippet + entity links
- Audit trail: browseable audit log with actor/action/entity filters

Enhanced live events page with correlation-id clustering (Groups toggle).
Added fetchAgentActivity/searchKnowledge/fetchAudit to the API client.
11 nav items now cover all planned control-room views.

plans/2026-07-08-control-room-webui.md

@@ -1,6 +1,20 @@
 # 2026-07-08 — Control room web UI
 
-**Status:** Planned
+**Status:** In Progress — N0-N3 (Nomos amendment: chat home + sessions), M1
+(dashboard/summary, Overview, Entities table, live event feed, shadcn-svelte
+component system), M2 (Operations ledger with approve/deny + cancel, Signals
+page with ack/resolve/mute, live nav badges), and M3 (graph explorer with
+`include=status` health coloring, per-relationship-type edge coloring +
+legend/filter, node-type filter, node search/highlight, entity detail page
+with uPlot metric charts, `#/entity/:slug` route) complete 2026-07-08. Event
+gap-fill (M2's
+other half) landed earlier in commit e8e230b, and approval creation's FK bug
+(gaps-plan A1) was already fixed, unblocking M2. While building M3, also
+fixed `GET /metrics` to make the `metric` query param genuinely optional
+(server now reports every metric recorded for the entity in range) — the
+implementation previously 400'd when it was omitted, contradicting its own
+documented-optional spec. M4 (agent activity, knowledge search page, audit,
+correlation grouping, polish) remains.
 
 ## Goal
 
@@ -31,8 +45,18 @@ Dependencies kept minimal:
 - `d3-force` — graph physics only; render SVG/canvas by hand
 - `uPlot` — ~45 KB canvas time-series, ideal for `/metrics` rollups
 - `openapi-typescript` — dev-only, generates `api-types.d.ts`
-- No SvelteKit (no SSR wanted — the Go binary is the server), no component
-  framework; hash router; hand-rolled dark-theme CSS.
+- No SvelteKit (no SSR wanted — the Go binary is the server); hash router.
+
+*Amendment 2026-07-08 (M1):* component library is
+[shadcn-svelte](https://www.shadcn-svelte.com/) over Tailwind CSS v4
+(`@tailwindcss/vite`), not hand-rolled CSS — Table, Card, Badge, Sidebar,
+Sheet, Select, Input, Button, Tabs, ScrollArea, Tooltip, Dialog,
+Dropdown-menu, Sonner installed via `npx shadcn-svelte add`. The existing
+dark GitHub-style palette (`app.css`) was ported into shadcn's CSS-variable
+theme contract (`--background`, `--card`, `--primary`, etc. under
+`@theme inline`) so old and new components share one palette. `d3-force` /
+`uPlot` remain the plan for the graph/charts milestones (M3), unaffected by
+this change.
 
 Build integration: commit a placeholder `web/dist/index.html` so backend-only
 `go build` never breaks; `make ui` runs the Vite build; add a node stage to