Add dashboard integrity/watchdog console

Surface integrity and watchdog state in the read-only dashboard via a new
/api/integrity endpoint and integrity_report(): watchdog/heartbeat
verdict, FIM baseline and package-DB anchor freshness, pacman keyring and
SigLevel posture, and Sentinel's own self-integrity footprint. The
endpoint summarizes existing anchors and heartbeats only — it runs no live
FIM or package verification from the request path, keeping the dashboard
read-only.

Add the enodia.integrity.v1 schema (schemas.py + docs/SCHEMAS.md) with a
contract test, a new "Integrity" dashboard tab and summary metric, and
web tests for the report shape, schema contract, endpoint, and console
wiring. Docs updated; completes the v1.0 "dashboard to local console"
roadmap item.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -296,11 +296,11 @@ sudo systemctl enable --now enodia-sentinel-web
   saved on first run and printed in the startup line. Open
   `https://<tailscale-ip>:8787/?token=…`.
 - **Read-only management**: incidents, timelines, alert inventory, posture
-  findings, event rule atlas, event tail, and dry-run response plans. No
-  commands are executed from the browser. JSON
+  findings, integrity/watchdog state, event rule atlas, event tail, and dry-run
+  response plans. No commands are executed from the browser. JSON
   API at `/api/status`, `/api/incidents`, `/api/respond/plan/<id>`,
-  `/api/posture`, `/api/rules`, `/api/alerts`, `/api/alerts/<id>`,
-  `/api/events`.
+  `/api/posture`, `/api/integrity`, `/api/rules`, `/api/alerts`,
+  `/api/alerts/<id>`, `/api/events`.
 - **Operator settings**: the self-contained dashboard includes a Settings menu
   with persistent local themes: Console, Paper, Contrast, LGBTQ, Trans, Dracula,
   Solarized Dark, Solarized Light, and Twilight. Static dashboard tests guard