Phases 11, 12: mcrctl CLI tool and mcr-web UI

Phase 11 implements the admin CLI with dual REST/gRPC transport,
global flags (--server, --grpc, --token, --ca-cert, --json), and
all commands: status, repo list/delete, policy CRUD, audit tail,
gc trigger/status/reconcile, and snapshot.

Phase 12 implements the HTMX web UI with chi router, session-based
auth (HttpOnly/Secure/SameSite=Strict cookies), CSRF protection
(HMAC-SHA256 signed double-submit), and pages for dashboard,
repositories, manifest detail, policy management, and audit log.

Security: CSRF via signed double-submit cookie, session cookies
with HttpOnly/Secure/SameSite=Strict, TLS 1.3 minimum on all
connections, form body size limits via http.MaxBytesReader.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

PROJECT_PLAN.md

@@ -20,8 +20,8 @@ design specification.
 | 8 | Admin REST API | **Complete** |
 | 9 | Garbage collection | **Complete** |
 | 10 | gRPC admin API | **Complete** |
-| 11 | CLI tool (mcrctl) | Not started |
-| 12 | Web UI | Not started |
+| 11 | CLI tool (mcrctl) | **Complete** |
+| 12 | Web UI | **Complete** |
 | 13 | Deployment artifacts | Not started |
 
 ### Dependency Graph