feat(web): add serve-web.sh + document hub smoke + prod-deploy path

serve-web.sh builds the release web bundle and serves it via
python3's stdlib http.server on http://127.0.0.1:8080, so an
AG reviewer can click a link instead of being asked to install
Flutter to see the demo.

RUN.md grows three new sections:

  - Web-Variante: single-command local serve, scope (mock works
    1:1, hub mode pending gRPC-Web in chain_client_sdk_dart).
  - Production deploy path: Hetzner-CX + Caddy, DNS
    reclaim.flemming.ai — matches the existing F∆I Hetzner
    pattern documented in fai_chain release-host.
  - Hub-Smoke-Test: how to verify the new HubRepository.list()
    wiring against a separately-running 'chain serve'
    (Hub-Reiter → Verbindung testen → flow.completed events
    populate the Heatmap-Tab once chain run has been invoked
    and the approval gate is cleared).

Signed-off-by: flemming-it <sf@flemming.it>

app/serve-web.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Local web preview for Recl∆Im.
+#
+# Builds the release web bundle (~16 s) and serves it on
+# http://127.0.0.1:8080 via python3's stdlib http.server so an
+# AG-member can poke the demo from a browser without the
+# Flutter dev tooling being installed on the reviewer's machine.
+#
+# Production path (NOT done by this script):
+#
+#   1. Copy build/web/ to a static host. Hetzner CX-Server +
+#      Caddy with auto-HTTPS is the existing F∆I pattern (see
+#      fai_chain release-host).
+#   2. Set the CSP, HSTS, and frame-ancestors headers Caddy
+#      already templates per F∆I deployment.
+#   3. Add reclaim.flemming.ai DNS A-record to the F∆I IP.
+#
+# For local dev: this script is enough.
+
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+PORT="${PORT:-8080}"
+HOST="${HOST:-127.0.0.1}"
+
+echo "[1/2] flutter build web --release"
+flutter build web --release
+
+echo "[2/2] serving build/web/ on http://$HOST:$PORT"
+echo "      Ctrl+C to stop."
+echo
+
+cd build/web
+exec python3 -m http.server "$PORT" --bind "$HOST"