REST/HTTP gateway and web dashboard

[jeremymanning]

Description

Per spec Phase 11 (T127-T128), the project needs:

1. REST/HTTP+JSON gateway: generated from protobuf schema (grpc-gateway style) for CLI/GUI/third-party integration
2. Web dashboard: React SPA (static CDN-servable) with donor and submitter workflows at parity with CLI

Requirements

• REST gateway exposes all gRPC services via HTTP+JSON
• Auto-generated from .proto files (tonic-web or custom gateway)
• Web dashboard: donor status, job submission, governance voting
• Static SPA deployable to CDN (no server-side rendering required)
• Authentication via Ed25519 signed tokens
• Rate limiting per contracts/README.md rate limit classes

Success Criteria

• All 6 gRPC services accessible via REST/HTTP+JSON
• Web dashboard provides donor and submitter feature parity with CLI
• Dashboard deployable as static files
• Authentication and rate limiting enforced
• Integration tests for REST endpoints

Testing (Principle V)

• Submit job via REST API → verify completion
• Fetch donor status via REST → verify matches CLI output
• Cast governance vote via web dashboard → verify recorded
• Rate limit testing: exceed configured limits → verify 429 response

[jeremymanning]

Partially addressed by spec 004 / PR #59 — not closing. RestGateway routing + Ed25519 auth + rate limiting logic exist. HOWEVER, the gateway is not bound to an actual HTTP listener in the daemon; no live HTTP server runs.

Remaining work tracked here.

[jeremymanning]

Spec 005 progress — PR #61

STATUS: No change — T116 daemon HTTP listener binding deferred.

REST gateway route handlers + auth + rate-limiting from spec 004 unchanged. The handlers compile and pass their unit tests, but src/agent/daemon.rs does not bind an actual HTTP listener at startup.

Deferred to next session along with GUI/Docker/Helm US8 tasks.

See notes/session-2026-04-19-spec-005-kickoff.md.