Fix web runtime status and document legacy login-service retirement (1.0.8)

[gateway]

Summary

The Jobs page reported a responding production web server as inactive because Next.js renames its process to next-server, which the process-name probe misses. The runtime route now uses its own execution as evidence that web is running, while preserving launchd management and restart restrictions.

 web runtime status
- infer liveness from process-name matching
+ recognize the web server handling this request

Release 1.0.8 also documents retiring legacy macOS login agents that fail before startup with Operation not permitted. On the affected Mac, only com.media-studio.api and com.media-studio.web were persistently disabled; their plist files and all installation/data files were retained. The Desktop launcher remains the normal startup path.

Evidence

• Before: live HTTP assertion returned API=running, web=inactive; two route regression cases failed. Both legacy agents were still enabled for login despite their permission-failure logs.
  After: original HTTP assertion returns both running; Chrome Jobs shows both running with a healthy runner and no console errors. Persistent launchctl state shows both legacy agents disabled.
• Six route tests pass, including stale service entries, unavailable inspection, untrusted requests and manual restart restrictions. Web lint, TypeScript and production build pass.
• CI exposed an existing Graph test race: a catch-all approval mock returned a plan to background session reads. A controlled delayed response reproduced the same crash; endpoint-specific responses fix it. All 1,131 web tests pass locally, including the controlled timing regression.
• Existing data counts remained 874 assets, 974 presets and 907 jobs. No generation requests, migrations or Python changes.

Merge Danger

Door: two-way

Code is revertable; legacy service configurations are retained. No database changes.

Blast Radius: diagnostics

Web runtime status and macOS troubleshooting documentation. API discovery and access controls are unchanged.