feat(phase-18): embedded web dashboard with chi + htmx + REST API + SSE

pkg/web: chi v5 server with go:embed static assets, HTML templates,
14 REST API endpoints (/api/v1/*), SSE hub for live scan/recon progress,
optional basic/token auth middleware.

cmd/serve.go: keyhunter serve [--telegram] [--port=8080] starts web
dashboard + optional Telegram bot.

cmd/serve.go

@@ -3,29 +3,45 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"os"
 	"os/signal"
 	"syscall"
 
+	"github.com/go-chi/chi/v5"
 	"github.com/salvacybersec/keyhunter/pkg/bot"
 	"github.com/salvacybersec/keyhunter/pkg/providers"
 	"github.com/salvacybersec/keyhunter/pkg/recon"
+	"github.com/salvacybersec/keyhunter/pkg/web"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
 
 var (
-	servePort    int
+	servePort     int
 	serveTelegram bool
 )
 
 var serveCmd = &cobra.Command{
 	Use:   "serve",
-	Short: "Start KeyHunter server (Telegram bot + scheduler)",
+	Short: "Start KeyHunter web dashboard and optional Telegram bot",
 	RunE: func(cmd *cobra.Command, args []string) error {
 		ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 		defer cancel()
 
+		// Open shared resources.
+		reg, err := providers.NewRegistry()
+		if err != nil {
+			return fmt.Errorf("loading providers: %w", err)
+		}
+		db, encKey, err := openDBWithKey()
+		if err != nil {
+			return fmt.Errorf("opening database: %w", err)
+		}
+		defer db.Close()
+		reconEng := recon.NewEngine()
+
+		// Optional Telegram bot.
 		if serveTelegram {
 			token := viper.GetString("telegram.token")
 			if token == "" {
@@ -34,24 +50,10 @@ var serveCmd = &cobra.Command{
 			if token == "" {
 				return fmt.Errorf("telegram token required: set telegram.token in config or TELEGRAM_BOT_TOKEN env var")
 			}
-
-			reg, err := providers.NewRegistry()
-			if err != nil {
-				return fmt.Errorf("loading providers: %w", err)
-			}
-
-			db, encKey, err := openDBWithKey()
-			if err != nil {
-				return fmt.Errorf("opening database: %w", err)
-			}
-			defer db.Close()
-
-			reconEng := recon.NewEngine()
-
 			b, err := bot.New(bot.Config{
 				Token:            token,
 				DB:               db,
-				ScanEngine:       nil, // TODO: wire scan engine
+				ScanEngine:       nil,
 				ReconEngine:      reconEng,
 				ProviderRegistry: reg,
 				EncKey:           encKey,
@@ -59,12 +61,29 @@ var serveCmd = &cobra.Command{
 			if err != nil {
 				return fmt.Errorf("creating bot: %w", err)
 			}
-
 			go b.Start(ctx)
 			fmt.Println("Telegram bot started.")
 		}
 
-		fmt.Printf("KeyHunter server running on port %d. Press Ctrl+C to stop.\n", servePort)
+		// Web dashboard.
+		webSrv := web.NewServer(web.ServerConfig{
+			DB:          db,
+			EncKey:      encKey,
+			Providers:   reg,
+			ReconEngine: reconEng,
+		})
+
+		r := chi.NewRouter()
+		webSrv.Mount(r)
+
+		addr := fmt.Sprintf(":%d", servePort)
+		fmt.Printf("KeyHunter dashboard at http://localhost%s\n", addr)
+		go func() {
+			if err := http.ListenAndServe(addr, r); err != nil && err != http.ErrServerClosed {
+				fmt.Fprintf(os.Stderr, "web server error: %v\n", err)
+			}
+		}()
+
 		<-ctx.Done()
 		fmt.Println("\nShutting down.")
 		return nil