Add React UI with Execution Explorer, auth, and standalone deployment

- Scaffold Vite + React + TypeScript frontend in ui/ with full design
  system (dark/light themes) matching the HTML mockups
- Implement Execution Explorer page: search filters, results table with
  expandable processor tree and exchange detail sidebar, pagination
- Add UI authentication: UiAuthController (login/refresh endpoints),
  JWT filter handles ui: subject prefix, CORS configuration
- Shared components: StatusPill, DurationBar, StatCard, AppBadge,
  FilterChip, Pagination — all using CSS Modules with design tokens
- API client layer: openapi-fetch with auth middleware, TanStack Query
  hooks for search/detail/snapshot queries, Zustand for state
- Standalone deployment: Nginx Dockerfile, K8s Deployment + ConfigMap +
  NodePort (30080), runtime config.js for API base URL
- Embedded mode: maven-resources-plugin copies ui/dist into JAR static
  resources, SPA forward controller for client-side routing
- CI/CD: UI build step, Docker build/push for server-ui image, K8s
  deploy step for UI, UI credential secrets

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

HOWTO.md

@@ -4,12 +4,17 @@
 
 - Java 17+
 - Maven 3.9+
+- Node.js 22+ and npm
 - Docker & Docker Compose
 - Access to the Gitea Maven registry (for `cameleer3-common` dependency)
 
 ## Build
 
 ```bash
+# Build UI first (required for embedded mode)
+cd ui && npm ci && npm run build && cd ..
+
+# Backend
 mvn clean compile          # compile only
 mvn clean verify           # compile + run all tests (needs Docker for integration tests)
 ```
@@ -65,7 +70,23 @@ curl -s -X POST http://localhost:8081/api/v1/agents/agent-1/refresh \
 # Response: { "accessToken": "new-jwt" }
 ```
 
-**Public endpoints (no JWT required):** `GET /api/v1/health`, `POST /api/v1/agents/register` (uses bootstrap token), OpenAPI/Swagger docs.
+**UI Login (for browser access):**
+```bash
+# Login with UI credentials (returns JWT tokens)
+curl -s -X POST http://localhost:8081/api/v1/auth/login \
+  -H "Content-Type: application/json" \
+  -d '{"username":"admin","password":"admin"}'
+# Response: { "accessToken": "...", "refreshToken": "..." }
+
+# Refresh UI token
+curl -s -X POST http://localhost:8081/api/v1/auth/refresh \
+  -H "Content-Type: application/json" \
+  -d '{"refreshToken":"<refreshToken>"}'
+```
+
+UI credentials are configured via `CAMELEER_UI_USER` / `CAMELEER_UI_PASSWORD` env vars (default: `admin` / `admin`).
+
+**Public endpoints (no JWT required):** `GET /api/v1/health`, `POST /api/v1/agents/register` (uses bootstrap token), `POST /api/v1/auth/**`, OpenAPI/Swagger docs.
 
 **Protected endpoints (JWT required):** All other endpoints including ingestion, search, agent management, commands.
 
@@ -228,6 +249,30 @@ Key settings in `cameleer3-server-app/src/main/resources/application.yml`:
 | `security.refresh-token-expiry-ms` | 604800000 | Refresh token lifetime (7d) |
 | `security.bootstrap-token` | `${CAMELEER_AUTH_TOKEN}` | Bootstrap token for agent registration (required) |
 | `security.bootstrap-token-previous` | `${CAMELEER_AUTH_TOKEN_PREVIOUS}` | Previous bootstrap token for rotation (optional) |
+| `security.ui-user` | `admin` | UI login username (`CAMELEER_UI_USER` env var) |
+| `security.ui-password` | `admin` | UI login password (`CAMELEER_UI_PASSWORD` env var) |
+| `security.ui-origin` | `http://localhost:5173` | CORS allowed origin for UI (`CAMELEER_UI_ORIGIN` env var) |
+
+## Web UI Development
+
+```bash
+cd ui
+npm install
+npm run dev          # Vite dev server on http://localhost:5173 (proxies /api to :8081)
+npm run build        # Production build to ui/dist/
+```
+
+Login with `admin` / `admin` (or whatever `CAMELEER_UI_USER` / `CAMELEER_UI_PASSWORD` are set to).
+
+The UI uses runtime configuration via `public/config.js`. In Kubernetes, a ConfigMap overrides this file to set the correct API base URL.
+
+### Regenerate API Types
+
+When the backend OpenAPI spec changes:
+```bash
+cd ui
+npm run generate-api   # Requires backend running on :8081
+```
 
 ## Running Tests
 
@@ -264,22 +309,22 @@ The full stack is deployed to k3s via CI/CD on push to `main`. K8s manifests are
 cameleer namespace:
   ClickHouse (StatefulSet, 2Gi PVC) ← clickhouse:8123 (ClusterIP)
   cameleer3-server (Deployment)     ← NodePort 30081
-  cameleer3-sample (Deployment)     ← NodePort 30080  (from cameleer3 repo)
+  cameleer3-ui (Deployment, Nginx)  ← NodePort 30080
 ```
 
 ### Access (from your network)
 
 | Service | URL |
 |---------|-----|
+| Web UI | `http://192.168.50.86:30080` |
 | Server API | `http://192.168.50.86:30081/api/v1/health` |
 | Swagger UI | `http://192.168.50.86:30081/api/v1/swagger-ui.html` |
-| Sample App | `http://192.168.50.86:30080/api/orders` |
 
 ### CI/CD Pipeline
 
-Push to `main` triggers: **build** (Maven, unit tests) → **docker** (buildx cross-compile amd64, push to Gitea registry) → **deploy** (kubectl apply + rolling update).
+Push to `main` triggers: **build** (UI npm + Maven, unit tests) → **docker** (buildx amd64 for server + UI, push to Gitea registry) → **deploy** (kubectl apply + rolling update).
 
-Required Gitea org secrets: `REGISTRY_TOKEN`, `KUBECONFIG_BASE64`, `CAMELEER_AUTH_TOKEN`, `CLICKHOUSE_USER`, `CLICKHOUSE_PASSWORD`.
+Required Gitea org secrets: `REGISTRY_TOKEN`, `KUBECONFIG_BASE64`, `CAMELEER_AUTH_TOKEN`, `CLICKHOUSE_USER`, `CLICKHOUSE_PASSWORD`, `CAMELEER_UI_USER` (optional), `CAMELEER_UI_PASSWORD` (optional).
 
 ### Manual K8s Commands