feat: Claude Code Monitor — lanes, pipelines and a merged workspace

Internal SmartGift build of a Claude Code monitoring dashboard.

Lanes: a durable unit of parallel agent work, one per working directory,
tracked across session restarts. Managed lanes are git worktrees the
dashboard provisions and can reset or remove behind a three-check destroy
guard and a counted preflight; adopted lanes are directories you already
own and are never destroyable.

Pipelines: a lane moves through pipeline stages. A stage the agent declares
with evidence renders green; a stage inferred from the tool-event stream
renders dashed amber and never counts as done. Detection is forward-only
within a 30-minute window, and never writes the declared stage.

Workspace: one page at /run with a lane grid, the selected lane's pipeline,
and a full Claude console behind a disclosure.

docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+  agent-monitor:
+    build: .
+    container_name: agent-monitor
+    ports:
+      # Publish on the host loopback only, so the dashboard is not reachable
+      # from the LAN out of the box (matches the server's default trust
+      # boundary — GHSA-gr74-4xfh-6jw9). To expose it on a LAN, change this to
+      # "${DASHBOARD_PORT:-4820}:4820" and set DASHBOARD_TOKEN below.
+      - "127.0.0.1:${DASHBOARD_PORT:-4820}:4820"
+    volumes:
+      # Same SQLite file as `npm start` / `npm run dev` on the host.
+      - ${CLAUDE_HOME:-~/.claude}/agent-dashboard:/app/data
+      - ${CLAUDE_HOME:-~/.claude}:/root/.claude:ro
+    environment:
+      - NODE_ENV=production
+      - DASHBOARD_PORT=4820
+      # Optional — required when Prometheus-in-Docker scrapes this container
+      # (host.docker.internal) or the full stack (agent-monitor). See monitoring/README.md.
+      - DASHBOARD_ALLOWED_HOSTS=${DASHBOARD_ALLOWED_HOSTS:-}
+      # DASHBOARD_HOST=0.0.0.0 and DASHBOARD_DATA_DIR=/app/data are baked into
+      # the image (see Dockerfile) so both `docker run` and Compose work as-is.
+    restart: unless-stopped