Add review-screen controls for the runner actions #200

Problem

With the opt-in runner block, the runner works only through POST /api/runner. The review screen has no control for any runner action, so a person must call the API by hand to run a task. The actions are start, resume, approve-continuation, cancel-task, cancel-attempt, retry, publish and close-pull-requests. (prepare-merge already has its control: the merge job from #194.)

The design also gives a person three choices on a task in needs human: review it anyway, add guidance and send it back, or cancel. A task in possibly already fixed needs "continue" or "cancel". None of these has a control.

Scope

Design: docs/designs/codeboost-plan-indexed-review.md, "How codeboost runs a plan" and "Needs human". Code: web/public/app.js, web/public/index.html, web/public/style.css, and a read of task status and the allowed actions from web/server.ts if the screen cannot get them today. The server's guards stay the authority: the screen offers an action, the server decides.

"Add guidance and send it back" needs the reject loop (#202). This issue shows that choice only when that loop exists, or leaves it out.

Acceptance

• The review screen shows the task status and only the actions the server allows in that status.
• Each control sends the action with a new UUID v4 action ID and the expected state and review versions. A refusal shows the server's message.
• A control in flight cannot be sent twice. A stale version reloads the task state.
• Controls are absent in demo mode and when no runner block is configured.
• Browser tests for each action and each refusal path. DESIGN.md followed.