feat(phase-18): embedded web dashboard with chi + htmx + REST API + SSE

pkg/web: chi v5 server with go:embed static assets, HTML templates,
14 REST API endpoints (/api/v1/*), SSE hub for live scan/recon progress,
optional basic/token auth middleware.

cmd/serve.go: keyhunter serve [--telegram] [--port=8080] starts web
dashboard + optional Telegram bot.

pkg/web/server.go

@@ -2,6 +2,10 @@
 package web
 
 import (
+	"html/template"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
 	"github.com/salvacybersec/keyhunter/pkg/dorks"
 	"github.com/salvacybersec/keyhunter/pkg/engine"
 	"github.com/salvacybersec/keyhunter/pkg/providers"
@@ -21,14 +25,33 @@ type ServerConfig struct {
 
 // Server is the central HTTP server holding all handler dependencies.
 type Server struct {
-	cfg ServerConfig
-	sse *SSEHub
+	cfg  ServerConfig
+	sse  *SSEHub
+	tmpl *template.Template
 }
 
 // NewServer creates a Server with the given configuration.
 func NewServer(cfg ServerConfig) *Server {
+	tmpl, _ := template.ParseFS(templateFiles, "templates/*.html")
 	return &Server{
-		cfg: cfg,
-		sse: NewSSEHub(),
+		cfg:  cfg,
+		sse:  NewSSEHub(),
+		tmpl: tmpl,
 	}
 }
+
+// Mount registers all web dashboard routes on the given chi router.
+func (s *Server) Mount(r chi.Router) {
+	// Static assets.
+	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFiles))))
+
+	// HTML pages.
+	r.Get("/", s.handleOverview)
+
+	// REST API (routes defined in api.go).
+	s.mountAPI(r)
+
+	// SSE progress endpoints.
+	r.Get("/events/scan", s.handleSSEScanProgress)
+	r.Get("/events/recon", s.handleSSEReconProgress)
+}