feat: add SPA, serve at /app/, update Dockerfile and README

- React + TanStack Router + shadcn/ui SPA under spa/
- serve spa/dist at /app/ with index.html fallback for client routing
- Dockerfile: node build stage for SPA, copy dist into runtime image
- README: document SPA, CORS_ORIGINS env var, architecture entry
- vite base set to /app/, manifest.json paths fixed

spa/src/hooks/use-webhooks.ts

@@ -0,0 +1,73 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
+import {
+  confirmWatch,
+  deleteToken,
+  dismissWatch,
+  generateToken,
+  getWatchQueue,
+  getWebhookTokens,
+} from "@/lib/api/webhooks"
+import type {
+  ConfirmWatchRequest,
+  DismissWatchRequest,
+  GenerateTokenRequest,
+} from "@/lib/api/webhooks"
+
+export const webhookKeys = {
+  tokens: ["webhook-tokens"] as const,
+  queue: ["watch-queue"] as const,
+}
+
+export function useWebhookTokens() {
+  return useQuery({
+    queryKey: webhookKeys.tokens,
+    queryFn: getWebhookTokens,
+  })
+}
+
+export function useGenerateToken() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (data: GenerateTokenRequest) => generateToken(data),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: webhookKeys.tokens })
+    },
+  })
+}
+
+export function useDeleteToken() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) => deleteToken(id),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: webhookKeys.tokens })
+    },
+  })
+}
+
+export function useWatchQueue() {
+  return useQuery({
+    queryKey: webhookKeys.queue,
+    queryFn: getWatchQueue,
+  })
+}
+
+export function useConfirmWatch() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (data: ConfirmWatchRequest) => confirmWatch(data),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: webhookKeys.queue })
+    },
+  })
+}
+
+export function useDismissWatch() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (data: DismissWatchRequest) => dismissWatch(data),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: webhookKeys.queue })
+    },
+  })
+}