feat(mcpd+deploy): serve web UI at /ui + smoke tests + docs (Stage 6)

The closing stage. mcpd now hosts the Stage 5 SPA, the Docker image
bundles the build artifact, a smoke test exercises the personality
HTTP surface end-to-end, and the user-facing docs spell out the
mental model.

mcpd:
- Add @fastify/static dep.
- New routes/web-ui.ts: registers /ui/* against a static bundle. Looks
  for the bundle at $MCPD_WEB_ROOT, then /usr/share/mcpd/web (the
  Docker image path), then a dev-tree fallback. Logs and skips
  cleanly if missing — API-only deploys keep working.
- SPA fallback: any /ui/<path> that doesn't match a file falls through
  to index.html so direct hits to react-router URLs work.
- /ui/* falls through to `kind: skip` in mapUrlToPermission, so the
  static assets are served unauthenticated. Each API call from the
  SPA still carries the bearer token.

Deploy:
- Dockerfile.mcpd builds the @mcpctl/web bundle in the same builder
  stage and copies dist/ to /usr/share/mcpd/web in the runtime image.

Smoke (personality.smoke.test.ts):
- Live mcpd flow: create secret/llm/agent/personality, attach an
  agent-direct prompt, verify the binding listing, reject double-
  attach (409) + foreign-agent prompt (400), set defaultPersonality
  by name, detach + delete cleanup.

Docs:
- New docs/personalities.md: VLAN-on-ethernet model, system-block
  ordering table, three prompt scopes, CLI walkthrough, web UI
  walkthrough, full API surface, RBAC notes.
- agents.md and chat.md cross-link.
- README's Agents section gains a Personalities subsection.

Test count after Stage 6:
  mcpd:   801/801      cli:  430/430
  web:    7/7          db:   58/62 (4 pre-existing)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -546,6 +546,31 @@ mcpctl chat reviewer --thread <id>
 Full reference: [docs/agents.md](docs/agents.md). User-facing chat guide:
 [docs/chat.md](docs/chat.md).
 
+### Personalities
+
+Same agent, different prompt bundles per turn. A **Personality** is a named
+overlay attached to an agent — when selected at chat time it appends extra
+prompts to the system block without replacing the agent's own prompt or
+project prompts. Think VLAN on top of ethernet: the underlying agent still
+works without one; with one, segmentation kicks in.
+
+```bash
+# Make a personality on an existing agent
+mcpctl create personality grumpy --agent reviewer --description "Be terse and slightly grumpy"
+
+# Add an agent-direct prompt (always-on for this agent — no toggle)
+mcpctl create prompt always-terse --agent reviewer --content "Always be terse." --priority 8
+
+# Use it
+mcpctl chat reviewer --personality grumpy
+```
+
+For binding prompts to personalities and the API surface, see
+[docs/personalities.md](docs/personalities.md). The browser editor at
+`https://mcpctl.ad.itaz.eu/ui/` covers the same flow with Monaco-based
+prompt editing — paste a session token (`mcpctl auth login`) or PAT to log
+in.
+
 ## Commands
 
 ```bash