Parent

• WebUI epic: #29
• Depends on: WEB-01 #30, WEB-02 #31, WEB-03 #32

Outcome

Build a small responsive Svelte application for authenticated tenant/session work, compiled to static assets and embedded in the Go BFF image.

Estimate

• 8 SP / 5 engineering days
• Risk: medium

Scope

• Add pinned Node and package-manager versions used only for build/test.
• Create a SvelteKit adapter-static application with generated typed API client boundaries.
• Implement Telegram sign-in/out, access-denied recovery and current identity.
• Implement authorized tenant selector, compute/quota status, session list, create/new, select and archive/unarchive.
• Implement bounded event history, text composer, image/file picker/upload progress and run status/result refresh.
• Cover responsive desktop/mobile layout, keyboard navigation, focus management and accessible loading/error/empty states.
• Keep provider/session secrets out of localStorage, sessionStorage and client logs.
• Build fingerprinted assets and embed them into cmd/web-bff with go:embed.
• Document local Svelte+Go development and production build commands.

Verification

• Type checking, linting and unit/component tests run in CI with locked dependencies.
• Playwright fixture tests cover sign-in, tenant selection, session/history, text, upload, archive and logout.
• Accessibility checks cover keyboard navigation, labels, focus and contrast for the MVP routes.
• Production bundle contains no server-side Node runtime and no secret-bearing configuration.
• Browser errors do not expose raw API/provider payloads.

Acceptance criteria

• The UI works in current desktop and mobile browsers at bounded viewport sizes.
• All product data comes from canonical Web API routes.
• Reload/deep-link behavior works through the Go static fallback.
• Authentication/session material remains HttpOnly or server-side.

Non-goals

• SSR or SEO pages.
• Visual workflow editor.
• Billing, search/summaries or full admin console.