feat(status-card): add public status route and page

[luyyyyy666]

Summary

• Add the public GET /status/{token} status-card API route and token-scoped event replay endpoint.
• Add the static-exportable public /status/[token] UI that reuses timeline, tool-call, and subagent rendering in read-only mode.
• Keep the UI build self-contained by avoiding network-dependent Google font fetching and asserting status/__token__.html in the export.

Closes #28
Closes #29

Test Plan

• uv run pytest python/packages/corlinman-server/tests/gateway/routes/test_status_public.py python/packages/corlinman-server/tests/test_status_token.py python/packages/corlinman-server/tests/test_agent_servicer.py::test_agent_status_card_uses_servicer_data_dir_for_signing_key python/packages/corlinman-server/tests/gateway/routes_admin_b/test_sessions_events.py python/packages/corlinman-server/tests/gateway/lifecycle/test_ui_static_serving.py -q
• uv run ruff check python/packages/corlinman-server/src/corlinman_server/gateway/routes/status.py python/packages/corlinman-server/tests/gateway/routes/test_status_public.py
• pnpm --filter @corlinman/admin exec vitest run "app/status/[token]/page.test.tsx"
• pnpm --filter @corlinman/admin exec tsc --noEmit
• pnpm --filter @corlinman/admin build
• git diff --check

[sweetcornna]

Closing as already shipped. The public status-card feature this PR implements (backend GET /status/{token} route + ui/app/status/[token]/ page) landed on main via the v1.13.0 status-card work (commits 7cc85a0 "shareable agent status link across all 7 channels" and 6ec2062 "/status command link + token revocation"), in a more advanced form that also includes token revocation (#34) and trajectory redaction.

This branch is based on a pre-v1.13.0 merge-base (a556d9e) and now conflicts in 7 files; merging it would regress the shipped version (e.g. it returns unredacted turn/event payloads on the public route). Issues #28/#29 are already closed and the equivalent functionality is live on main. Thanks for the work!