HTTP surface of the inspector: serves the single-page UI from priv/inspector/ and a JSON + SSE bridge to inspector sessions.

Every /api/* call requires the per-run bearer token (also accepted as ?token= for EventSource, which cannot set headers). Binds are expected to be localhost-only; any cross-origin browser request is rejected.