Closes #95

Summary

• add authenticated, same-origin and CSRF-bound cancel/retry endpoints for daemon-owned sync and RAG jobs
• persist bounded hashed idempotency receipts and report created, coalesced, no-work, requested, and completed outcomes
• expose public work identity, action eligibility, progress retention, throughput/ETA, and failure filters
• add URL-restored job filters/detail, structured timeline, interruption/rate-limit states, modal confirmation, and receipt feedback
• keep System as the default theme with explicit Light/Dark/System controls

Verification

• go test ./...
• go test -race ./internal/adminhttp ./internal/servicectl
• go vet ./...
• npm run check
• npm test
• Playwright Chromium: 6 passed, 1 live-environment test skipped
• git diff --check

No tag, release, or go install was produced for this slice.