Add web frontend with JWT auth, RBAC, SSE dashboard, and config editor

- FastAPI + htmx + Jinja2 web frontend, started with --web flag
- JWT HS256 auth (WEB_SECRET_KEY) with httpOnly cookies; access (15 min) +
  refresh (7 day) tokens; refresh rotation + JTI revocation in data/web.db
- RBAC: superadmin > admin > reader enforced per route
- Live SSE dashboard fed by tui/events broadcast queue
- Config editor: keyword groups and channel list saved to data/runtime_config.json
  and hot-reloaded in-process (scorer.reload_from_config, signal_channel_changed)
- config.py migrated to load groups/channels from runtime_config.json;
  falls back to hardcoded defaults when file absent
- tui/events.py: subscribe/unsubscribe broadcast, set_bot_context/signal_channel_changed
- utils/scorer.py: import config as _config (fixes local binding); reload_from_config()
- utils/database.py: count_by_severity, recent_for_domains, count_by_severity_for_domains
- 53 new tests (events bus, JWT lifecycle, web DB CRUD, RBAC enforcement,
  config round-trip); total 141 passing

tests/conftest.py

@@ -7,6 +7,11 @@ os.environ.setdefault("API_HASH", "dummy_hash_for_tests")
 os.environ.setdefault("BOT_TOKEN", "0:dummy_bot_token")
 os.environ.setdefault("NOTIFY_CHAT_ID", "99999")
 
+# Web frontend test defaults — set once here so all web test files see the same values.
+os.environ.setdefault("WEB_SECRET_KEY", "test-secret-key-for-pytest")
+os.environ.setdefault("WEB_ADMIN_USER", "superadmin")
+os.environ.setdefault("WEB_ADMIN_PASS", "superpass")
+
 import pytest
 import config
 import utils.scorer as scorer
@@ -22,10 +27,10 @@ def patched_keywords(monkeypatch):
     """
     Override TARGET_KEYWORDS for the duration of a test and rebuild the
     scorer's module-level globals so scoring logic uses known test patterns.
+
+    scorer.py now reads _config.TARGET_KEYWORDS at call time via `import config as _config`,
+    so patching config.TARGET_KEYWORDS is sufficient — no direct scorer patch needed.
     """
     monkeypatch.setattr(config, "TARGET_KEYWORDS", TEST_KEYWORDS)
-    # scorer.py uses `from config import TARGET_KEYWORDS` — a local binding that
-    # doesn't update when config.TARGET_KEYWORDS is patched. Patch it directly.
-    monkeypatch.setattr(scorer, "TARGET_KEYWORDS", TEST_KEYWORDS)
     monkeypatch.setattr(scorer, "EMPLOYEE_DOMAINS", scorer._build_employee_domains())
     monkeypatch.setattr(scorer, "ORG_DOMAINS", scorer._build_org_domains())