feat(dashboard): SSE realtime + story rollback button

Replaces 5s polling on /echo/ralph.html with EventSource streaming and adds
a rollback control for the running Ralph cards.

Server (dashboard/handlers/ralph.py):
- /api/ralph/stream — Server-Sent Events. Emits `event: status` whenever a
  signature over the projects' state changes (poll filesystem at 2s); emits
  `event: heartbeat` every 30s to keep proxies happy. Disables proxy
  buffering via X-Accel-Buffering:no.
- /api/ralph/<slug>/rollback (POST) — runs `git revert --no-edit HEAD` in
  the project; falls back to `git reset --hard HEAD~1` only if revert
  reports conflict. After rolling back the commit, decrements `passes` on
  the last user story marked complete in prd.json (atomic temp+rename
  write, same pattern as ralph_dag.py). Returns
  `{success, message, reverted_commit, story_reverted, method}`.
- _ralph_validate_slug tightened to a strict regex (alphanum + dash +
  underscore, ≤64 chars) plus explicit ../, /, \ rejection. All previously
  accepted slugs still pass; URL-encoded traversal and shell metachars
  now blocked before the filesystem is touched.
- _ralph_collect_status / _ralph_signature factored out of
  handle_ralph_status so the SSE loop can reuse them and detect changes
  cheaply.

Server (dashboard/api.py):
- HTTPServer → ThreadingHTTPServer with daemon_threads=True. SSE is a
  long-lived response; without threading a single client would block all
  other dashboard endpoints.
- /api/ralph/stream (GET) and /api/ralph/<slug>/rollback (POST) wired
  into the dispatch.

Client (dashboard/ralph.html):
- EventSource('/api/ralph/stream') with permanent fallback to 5s polling
  when readyState=CLOSED (no server, CORS blocked, browser without SSE).
- Indicator badge: 🟢 Live (SSE), ⏱ Polling (fallback), Offline.
- Rollback button (undo-2 icon) on running cards; native confirm() with
  message: "Asta va da git revert HEAD pe <slug> și va decrementa ultima
  story trecută. Continui?"

Tests (tests/test_dashboard_ralph_endpoint.py, +20 cases):
- Strict slug validator: underscore allowed, >64 rejected, special chars
  / backslash / URL-encoded traversal rejected.
- _ralph_collect_status + _ralph_signature: stable when nothing changes,
  flips when project added or `passes` toggles.
- Rollback: invalid slug → 400, non-git project → 400, real two-commit
  repo revert succeeds and decrements last passing story (US-002 goes
  passes:false while US-001 stays passes:true), no-passing-stories case
  succeeds with story_reverted=None, response shape contract, atomic
  helper leaves no .tmp file behind.
- API routing smoke: confirms ThreadingHTTPServer + stream + rollback
  references present in dashboard/api.py.

39/39 tests pass on tests/test_dashboard_ralph_endpoint.py. Pre-existing
failures in test_dashboard_constants.py::test_base_dir_is_echo_core (the
worktree dir is `echo-core-realtime`, not `echo-core`) and
test_dashboard_unified_index.py::test_index_has_all_panels are unrelated
to this change and reproduced on master.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashboard/api.py

@@ -7,7 +7,7 @@ server bootstrap.
 """
 import json
 import sys
-from http.server import HTTPServer, SimpleHTTPRequestHandler
+from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 
 # Make dashboard/ importable for the handler submodules (constants,
@@ -159,6 +159,8 @@ class TaskBoardHandler(
             self.handle_eco_doctor()
         elif self.path == '/api/ralph/status' or self.path.startswith('/api/ralph/status?'):
             self.handle_ralph_status()
+        elif self.path == '/api/ralph/stream' or self.path.startswith('/api/ralph/stream?'):
+            self.handle_ralph_stream()
         elif self.path.startswith('/api/ralph/'):
             # /api/ralph/<slug>/log or /api/ralph/<slug>/prd
             parts = self.path.split('?', 1)[0].split('/')
@@ -233,11 +235,18 @@ class TaskBoardHandler(
             self.handle_eco_git_commit()
         elif self.path == '/api/eco/restart-taskboard':
             self.handle_eco_restart_taskboard()
-        elif self.path.startswith('/api/ralph/') and self.path.endswith('/stop'):
+        elif self.path.startswith('/api/ralph/'):
+            # /api/ralph/<slug>/{stop,rollback}
             parts = self.path.split('?', 1)[0].split('/')
             if len(parts) >= 5:
                 slug = parts[3]
-                self.handle_ralph_stop(slug)
+                action = parts[4]
+                if action == 'stop':
+                    self.handle_ralph_stop(slug)
+                elif action == 'rollback':
+                    self.handle_ralph_rollback(slug)
+                else:
+                    self.send_error(404)
             else:
                 self.send_error(404)
         else:
@@ -264,5 +273,8 @@ if __name__ == '__main__':
     os.chdir(KANBAN_DIR)
 
     print(f"Starting Echo Task Board API on port {port}")
-    httpd = HTTPServer(('0.0.0.0', port), TaskBoardHandler)
+    # ThreadingHTTPServer permite SSE long-lived (/api/ralph/stream) fără să
+    # blocheze celelalte request-uri.
+    httpd = ThreadingHTTPServer(('0.0.0.0', port), TaskBoardHandler)
+    httpd.daemon_threads = True
     httpd.serve_forever()