Feat/tui stats dashboard

[RonCodes88]

Summary

Brings the terminal dashboard (agentlock dashboard) to feature parity with the web dashboard and adds an operational Stats tab — time-windowed allow/deny
counters, a volume-by-deny-rate sparkline, top deny rules, top deny tools, and source breakdown. Adds a tool field to ledger entries so top-deny-tool insights
can name actual tools (Bash, Read) instead of opaque correlation ids.

What changed

• Stats tab: new operational view with 1h / 24h / 7d / all windows, inline counters (total / allow / deny / rate), single-row sparkline (bar
  height = volume, color = deny rate), per-window time axis with weekday letters on 7d, top-N deny rules + tools, by-source breakdown.
• Gates write actions: a add via $EDITOR, e edit via $EDITOR, space toggle disabled, M cycle mode (inherit→monitor→enforce), x x two-key
  delete confirmation.
• Events filters + detail: f opens filter line-edit (source/verdict/rule), tab cycles fields, c clears, i toggles internal sources, enter opens a
  detail modal showing every ledger field, H toggles full hashes.
• Sessions toggle: i shows/hides internal harnesses to match web behavior.
• Header: now displays Merkle seq / count / root from /v1/ledger/root, polled live.
• Backend: new GET /v1/ledger/insights?window=1h|24h|7d|all&top=N endpoint walking the JSONL ledger with time bucketing — 12 × 5min, 24 × 1h, 7 × 24h, or
  unbounded.
• Schema: LedgerEntry.Tool added (omitempty); plumbed through gate-check + 8 hook handlers (claude / codex / cursor / gemini × pre+post).
• CLI client: addGate, patchGate, ledgerInsights methods + LedgerInsightsResponse / InsightWindow types.
• $EDITOR helper: spawns $VISUAL > $EDITOR > vi on a tempfile; renderer suspends so the editor owns the TTY cleanly.

Test plan

• bun test passes (cli)
• cargo test passes (ledger)
• go test -race ./... passes (control-plane)
• Manual test: launch ./agentlock dashboard against a running daemon. Confirm five tabs render. On Stats, hit 1 / 2 / 3 / 0 to switch windows;
  sparkline + axis update. Generate denies (./agentlock fake-hook --tool Bash --command 'rm -rf …') and confirm top deny rules and top deny tools populate.
  On Gates, exercise a / e / space / M / x x. On Events, exercise f / tab / c / enter / H. Cross-check every change against the web dashboard
  at :7879 — the two views should agree within the 2s poll window.

Notes for reviewers

• Schema migration: LedgerEntry.Tool is additive (omitempty). Existing JSONL entries decode with Tool == "" and are skipped by top_tools_deny
  aggregation rather than mis-attributed. The TUI surfaces a one-line hint when the deny window contains only legacy entries so it doesn't look like a bug.
• OpenTUI 0.1.107 layout quirk: bare <text> siblings inside a flexDirection="column" box collapse onto a single row once content widens — this is why
  CounterRow is single-line and the Footer wraps each line in its own <box flexDirection="row">. Worth knowing if you touch other column layouts.
• Editor flow suspends/resumes the OpenTUI renderer; falls back gracefully if suspend() isn't available. Tempfile is created with mode 0o600 and removed
  in finally.
• Sparkline encoding: bar height = total volume per bucket (allow + deny), color = deny rate (green / cyan / amber / red bands). Empty buckets render dim
  · so the bucket count stays readable.
• No new external dependencies — extends the existing OpenTUI + React + yaml stack already shipping in cli/.
• Follow-ups: extend filtering to backend (/v1/ledger/list?since=…) once volume justifies it; today filters apply client-side over the SSE buffer,
  matching the web dashboard's behavior.

Checklist

• I read CONTRIBUTING.md
• No secrets, real tokens, or .env content committed
• Public docs updated if user-facing behavior changed