Add Workspace Mission Control operations surfaces

[Rhinoculips]

Summary

Adds the Workspace operations surfaces that were already built locally and hardens the Tailscale/login smoke path:

• Mission Control dashboard and read-only system/summary APIs
• Notion browser and server-side Notion proxy APIs
• Outreach and Approval Queue screens
• Project-aware Workspace/session support with Obsidian export helpers
• Root/Tailscale proxy support in server-entry.js
• Config auth hardening so unauthenticated /api/claude-config returns JSON 401 instead of a server 500
• Ignores local memory/handoffs/ swarm artifacts so they do not pollute repo status

Verification

Rebased onto origin/main successfully with no conflicts.

Targeted tests passed:

pnpm test src/lib/project-context.test.ts src/screens/chat/utils.test.ts src/hooks/use-projects.test.ts src/server/projects-store.test.ts src/server/projects-obsidian-export.test.ts src/routes/api/-hermes-config.test.ts

Result: 6 test files passed, 27 tests passed.

Production build passed:

pnpm build

Tailscale smoke tested against http://100.72.54.12:3000 after restarting com.hermes.workspace:

• /mission-control -> 200 HTML
• /notion -> 200 HTML
• /outreach -> 200 HTML
• /approval-queue -> 200 HTML
• /api/auth-check -> 200 JSON
• /api/claude-config -> 401 JSON, expected while logged out
• /api/projects -> 401 JSON, expected while logged out
• /api/mission-control/system -> 401 JSON, expected while logged out
• /api/mission-control/summary -> 401 JSON, expected while logged out
• /api/notion/sources -> 401 JSON, expected while logged out

Browser smoke:

• http://100.72.54.12:3000/mission-control renders the Hermes Workspace login screen
• Browser console errors: 0

Notes

Full repo test suite has unrelated pre-existing failures in MCP/i18n/chat/playground areas; this PR was verified with targeted tests for the touched Workspace surfaces plus production build and browser smoke.