feat: local MCP harness (tools/resources/prompts) + Harness UI page

Streamable-HTTP MCP server on POST /mcp: device.state, attack.deploy/stop/
status/deauth/capture/export_hc22000, loot.handshakes/enterprise_creds,
recon.aps/isearch/devices, pineap.kick_client/set_filter tools; recon DB +
bundled opencode skills resources; attack playbook prompts. Cookie or Bearer
auth. Harness page shows endpoint, token, curl snippet, capability explorer
and a copy-paste pi.dev prompt. scripts/harness_stdio.py for stdio-only
agents.

payload/user/remote_access/pager-webui/www/js/app.js

@@ -34,6 +34,7 @@ const App = (() => {
     { key: 'recon', label: 'Recon', hash: '#/recon', icon: 'recon' },
     { key: 'logging', label: 'Logging', hash: '#/logging', icon: 'logging' },
     { key: 'modules', label: 'Payloads', hash: '#/modules', icon: 'modules' },
+    { key: 'harness', label: 'Harness', hash: '#/harness', icon: 'extension' },
     { key: 'settings', label: 'Settings', hash: '#/settings', icon: 'settings' }
   ];
   const railDividers = new Set(['logging']);
@@ -418,7 +419,8 @@ const App = (() => {
     '#/settings/wifi': 'settings_wifi',
     '#/settings/led': 'settings_led',
     '#/settings/advanced': 'settings_advanced',
-    '#/settings/help': 'settings_help'
+    '#/settings/help': 'settings_help',
+    '#/harness': 'harness'
   };
 
   return { init, route, toast, showLogin, checkInternet, wsUrl: (p) => WS_BASE + p,