sanad: coder panel P1b — panel spine, request cards, gated Coder tab

[osodev-1]

P1b of the coder-panel effort (spec: docs/superpowers/specs/2026-08-12-coder-agent-panel-design.md, plan: docs/superpowers/plans/2026-08-13-coder-panel-p1b-panel-spine.md).

The browser gets the Coder panel spine:

• Shared NDJSON reader (lib/ndjson.ts); architect client behaviorally unchanged
• lib/coder/{types,client,transcript}: conversation lifecycle with one-time-ticket discipline (open falls through to create with a re-mint), journal-driven fold with the full request lifecycle — LAST-WINS semantics, decided blocks frozen against stale replays, post-end items folded
• uiState coder slot (pending-never-persisted enforced at the zod layer) + server-computed coderEnabled flag
• RequestCards: inline Approval (allow / allow-for-session / deny / deny-with-feedback) + Question (multi-select, synthetic Other) cards, interactive only while state === "pending"
• CoderPanel (adapts ArchitectPanel's proven resilience machinery): ensure-conversation begin, server-authoritative reload resume, pending-request recovery, respond wiring with off-stream optimistic folds, stall watchdog, queue
• Gated singleton Coder tab + mounted-hidden pane — fully dark unless SANAD_CODER_PANEL_EMAILS allows the user
• Backend carry-items from P1a's final review: journal-before-register hardening + two locking tests

Review trail: per-task gates (2 fix rounds: transcript replay freeze; three CoderPanel findings), then a final whole-branch review that caught a Critical cross-task seam — persisted conversationId was never adopted after async hydration (reload leaked conversations to the cap) — fixed and re-verified in one fix wave.

Verification: web suite 283 passed, tsc clean; terminal-server 179 passed. Manual QA required before enabling for real users (script in the PR discussion): set backend CODER_ENABLED=1 + SANAD_CODER_PANEL_EMAILS, exercise the approval flow, reload mid-approval, deny-with-feedback, question multi-select/Other, allow-for-session, and reload-resume.

Known fork-CI noise: pr-title-checker + typos fail on upstream Kimi artifacts (same as PRs #1–2) — not required checks.