feat(dashboard): unified workspace hub — cookie auth, 9-state projects, planning chat

Merges workspace.html + ralph.html into a single unified project hub with:
- Cookie-based auth (DASHBOARD_TOKEN, HttpOnly, SameSite=Strict)
- 9-state project badge system (running-ralph/manual, planning, approved,
  pending, blocked, failed, complete, idle) with BUTTONS_FOR_STATE matrix
- SSE realtime + polling fallback, version-based optimistic concurrency (If-Match)
- Planning chat modal (phase stepper, markdown bubbles, 50s+ wait state, auto-resume)
- Propose modal (Variant B: inline Plan-with-Echo checkbox)
- 5-type toast taxonomy (success/info/warning/busy/error, 3px colored left-bar)
- Inter font self-hosted + shared tokens.css design system + DESIGN.md
- src/jsonlock.py (flock helper, sidecar .lock for stable inode)
- src/approved_tasks_cli.py (shell-safe wrapper for cron/ralph.sh)
- 55 new tests (T#1–T#30) + real jsonlock bug fix caught by T#16/T#28
- No emoji anywhere (enforced by test_dashboard_no_emoji.py)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dashboard/handlers/workspace.py

@@ -11,13 +11,15 @@ from urllib.parse import parse_qs, urlparse
 
 import constants
 
+from handlers._validators import validate_slug
+
 
 class WorkspaceHandlers:
     """Mixin for /api/workspace and /api/workspace/*."""
 
     def _validate_project(self, name):
         """Validate project name and return its path, or None."""
-        if not name or '/' in name or '..' in name:
+        if validate_slug(name) is not None:
             return None
         project_dir = constants.WORKSPACE_DIR / name
         if not project_dir.exists() or not project_dir.is_dir():