Add human-in-the-loop Inbox + alerts

[mlund01]

Summary

Commander half of the HITL feature: operators see and answer questions agents have asked via builtins.human.ask through a new Inbox surface, plus toast + chime alerts when new questions arrive away from the Inbox.

What's wired

API proxy (internal/api/humaninputs.go)

• GET /instances/:id/human-inputs — list (proxied to squadron, the source of truth)
• POST /instances/:id/human-inputs/:callId — submit a resolution; commander tags responder identity from the session
• GET /instances/:id/human-inputs/stream — SSE stream of HumanInputRequested / HumanInputResolved events

Inbox page

• List mode + Focus mode (oldest-first carousel that auto-advances after submit, for ripping through a backlog).
• Single-select → quick-reply buttons.
• Multi-select → toggle buttons with ✓/○ glyph + a Send (N) button that JSON-encodes the selected set.
• Free-text "Other…" fallback always available.

Inline card (HumanInputCard.tsx) reuses the same widget on mission detail. Resolved responses render through formatResolvedResponse so multi-select shows A, C instead of ["A","C"].

Alerts hook (use-human-input-alerts.ts)

• Subscribes to the SSE stream; fires toast + chime on every new question.
• Chime is the snappy first-second of sonar-ping.mp3, capped via Web Audio gain envelope.
• HTMLAudio fallback for backgrounded tabs where AudioContext can suspend in ways resume() alone doesn't recover. Both paths primed on first user gesture (Safari/Chrome autoplay policy).
• Skips toast + chime when on the Inbox page (operator is presumably handling things).

Tests

• HumanInputCard.test.ts (vitest, 9 cases): formatResolvedResponse — verbatim for single/free-text; expand JSON array to comma list for multi-select; graceful fallback on malformed JSON, non-array, non-string entries, empty arrays, missing response.

Dependencies

This PR depends on mlund01/squadron-wire#11 — the wire types for HumanInputRecord, HumanInputRequestedData, HumanInputResolvedData, and the MultiSelect field.

go.mod keeps the existing replace github.com/mlund01/squadron-wire => ../squadron-wire directive (with its TEMP: revert before merging comment) until wire #11 merges and a new tag is published. Drop the replace + bump the require version before merging this PR.

Test plan

• npm run dev from commander/web runs cleanly; npm run test passes.
• go build ./... from commander/ succeeds (after wire dep is published).
• Run ask_human_test mission end-to-end: questions appear in the Inbox; toast + chime fire when the tab is not focused on the Inbox; multi-select Q4 shows toggle buttons + Send (N); resolutions submitted in commander clear the row in real time and update the corresponding Discord message.
• Cmd+Tab away from the browser, trigger a new question, verify the chime fires (HTMLAudio fallback path).

🤖 Generated with Claude Code