refactor: make Console the hosted account portal and ship runtime binaries

[Hydralerne]

What & why

Console is Mindwire's hosted account and Cloud Computer portal. Replace the browser agent/fleet workspace with Overview, Cloud Computers, Devices, Plans & billing, and Account. Remove self-hosted Console configuration, runtime execution routes and the SDK dependency from Console. Existing account, Cloud purchase, encrypted directory and notification records remain intact.

Connection management uses Better Auth's existing sessions. The portal lists only owned connections without session tokens and revokes them by opaque ID. Profile and password changes use the existing account API. Cloud purchases, checkout recovery, power controls and subscription actions reuse the existing owner-scoped Cloud module and shared retail catalog.

Stop publishing Console and runtime images to GHCR. The runtime ships as checksum-verified GitHub Release binaries; the TypeScript SDK continues on npm. Console and website retain source-built SaaS deployment checks. New native and SDK Docker workspaces bootstrap the shared daemon installer in a standard Node container. Existing owned runtime-image containers remain discoverable and are not recreated. Custom SDK images keep their commands; default published ports bind to loopback. Docker pulls consume the client's progress stream and reject streamed registry errors before container creation. Copied dependencies belong to the unprivileged runtime user so private install permissions cannot break SQLite resolution.

Update the public website, installation documentation, release wizard and CI to match these boundaries. This intentionally removes the former self-hosted/browser agent Console product and its APIs. Historical published images are not deleted, preserving older clients.

Validation

All nine GitHub checks passed on head a0e62d2, including the Apple simulator build, both SaaS containers and the default Docker binary bootstrap.

• Console and website typechecks and production builds.
• Console: 38 SQLite tests passed; 39 PostgreSQL tests passed, including session ownership, CSRF, password/session revocation, existing purchase recovery, push migration and encrypted directory behavior.
• SDK: typecheck, build and 220 unit tests passed. Real Docker tests are gated separately.
• Native: 5 Docker workspace tests passed on the iOS simulator, including legacy identity compatibility and ownership checks.
• Browser: sign-in, connection revocation, profile update, plan selection without accidental checkout, existing pricing and checkout-return redirects, Mac/Xcode capacity validation and seven mobile pages without horizontal overflow; desktop/mobile screenshots inspected.
• Go suite and vet passed. Release script dry run and workflow job dependencies validated.
• CI passed the source-built Console and website container builds/startup checks and the real default Docker E2E (plain Node container, binary bootstrap, authenticated loopback access). The Docker E2E also runs in the release gate.

No live purchase, production migration or Cloud deployment is part of this PR. Preserve the existing production signing/encryption keys, PostgreSQL data and Firebase credential mount when deploying.

Component

• mindwire (TypeScript)
• docs
• repo / CI
• Console and Apple Docker workspace integration

Type of change

• Breaking change
• New feature

Checklist

• Read CONTRIBUTING.md.
• SDK typecheck, build and unit tests pass.
• Updated behavioral and ownership regression tests.
• Updated installation and product documentation.