feat(ios): add read-only Cloud compute monitoring - #2011

Summary

Read-only Cloud Compute pools monitoring, gated by pools.manage and the existing development/preview Cloud flag. Production stays off.

• Native happy://settings/computes, Settings row, and permission-aware search.
• Pools → machines → status, last exchange, supervisor version, configured sandbox capacity, startup CPU/RAM/workspace-volume facts, and durable agent placements.
• Unknown capacity stays “3 sandboxes,” not “3 / 0”; missing or null host facts stay Unknown. Revoked machines are collapsed under “N revoked” at the bottom.
• Thirty-second visible-page polling and bounded event refreshes; overlap coalescing, cancelled late-response rejection, and cleanup on hiding or account switching.
• Permission loss and 401/403 clear protected content; transient failures retain explicitly stale data. Membership changes re-read permissions, never interpret an event's role as grants.
• No attach/detach, drain/undrain, enrollment/join-token, revoke, or other compute mutation controls or API methods.

A route's 403 is intentionally latched for that page instance. Returning and reopening it, or an observed permission-loss→grant transition, permits a new query. Unchanged cached grants do not override the route refusal.

Verification

• Fresh rebased core/auth/link checks: 105 passed (10 Compute, 12 Providers, 8 permissions, 27 Markdown parser/settings links, 42 auth/transport, 6 Happy links).
• Fresh hosted integration: 28 passed (7 Compute, 7 Providers, 10 unified Settings, 4 Connection page). Compute covers native navigation, monitoring permission versus compute.use, production off, live Settings/search permission changes, forbidden clearing, null facts/revoked expansion, and subscription lifetime.
• Fresh full UIKit suite: 482 executed, zero failures, one existing Reduce Motion skip.
• Independent source review passed after its cancelled-back-swipe subscription finding was fixed.
• Regression red proof: repeated appearance accumulated 2/3/4 event listeners and left 3 after hiding. Green proof: exactly 1 while visible and 0 after hiding. No assertion/budget relaxation.
• Simulator screenshots inspected; no live QA node actions and no physical-device testing.

Evidence on Kirill Mac:

• Fresh rebased hosted, core/auth and full UIKit: /Users/kirilldubovitskiy/ctb-out/compute-rebased.tSE5UE/.
• Earlier final hosted and core/auth: /Users/kirilldubovitskiy/ctb-out/compute-hosted.dctDbo/.
• Subscription red: /Users/kirilldubovitskiy/ctb-out/compute-hosted.LSfHjV/hosted.xcresult.

Rebased onto main 3f616d0b6431b7cdc1a8f37066381cddb2baeed7 after #1992, #2010 and #1993 merged. Independent rebase-drift review passed: Provider and Compute routes, permissions and settings rows are both preserved, and Compute implementation/test files are byte-identical. Fresh combined simulator/core verification on exact head 003e9d0e0 passed as listed above.

Review/CI only: do not merge or upload a preview without further direction.