Add React QWebEngine composer renderer

[dovvnloading]

Summary

Add the first production slice of the React + TypeScript composer running inside the existing PySide6/QWebEngine desktop app.

What changed

• Added a typed React/TSX composer UI with context review, attachment action, route status, keyboard send behavior, request status, cancel, and retry affordances.
• Added a versioned JSON Python bridge that keeps provider routing, graph context, attachments, request lifecycle, and security authority in Python.
• Added an opt-in GRAPHLINK_COMPOSER_RENDERER=web host with legacy Qt fallback by default.
• Hardened the local page boundary with inlined bundled assets and qrc WebChannel loading.
• Added frontend lockfile/build configuration, checked-in production assets, bridge tests, and qrc sandbox coverage.

Validation

• npm run check
• python -m pytest -q --basetemp .pytest-tmp — 433 passed
• python -m compileall -q graphlink_app
• Bundle contract checks confirm no external runtime asset references.

Known limitation

The live QWebEngine offscreen constructor probe exits in this sandbox before producing a diagnostic. Host imports, inline bundle, bridge contract, and headless Qt coverage are included; the web renderer remains opt-in pending interactive desktop QA.