Merge live security workbench + managed Kali deployment into this branch

[Copilot]

What does this PR do?

Mirrors upstream spetro511-cyberstrike-ux-strategy (source of CyberStrikeus/CyberStrike#134 / local PR #1) into this branch. Adds a session-scoped security workbench (activity, mission, topology, memory panels), an approval-gated Nmap workflow, observer access, MCP catalog, and a reproducible managed Kali deployment.

• History integration: repo is a shallow, single-branch clone with no shared history between this branch and the feature branch; progressively deepened fetch until a merge base surfaced, then merged as a genuine two-parent commit (no conflicts).
• Web UI: new activity/mission/topology/memory panels (packages/app/src/pages/session/*) that keep panel state current without requiring the tab to be visible.
• Backend: Nmap scan tool + topology/nmap persistence, structured memory store + reflection, event log, observer auth role, MCP catalog with pinned install states, system capabilities routes — plus additive migrations.
• Deployment: systemd unit (contrib/systemd/cyberstrike-web.service) for a localhost-only managed Kali install.

Type of change

• Bug fix
• New feature / agent
• Security tool / MCP server / Bolt plugin
• Agent skill / knowledge base
• UI / TUI improvement
• Documentation
• Refactor / performance
• CI / infrastructure

Security impact

• This PR adds or modifies tool execution (shell, file, network)
• This PR changes agent permissions or scope
• This PR modifies authentication / authorization logic
• This PR has no security impact

How did you verify it works?

• bun turbo typecheck on the changed packages (cyberstrike, app, sdk/js)
• Backend test suites for topology, memory, event, MCP catalog, server auth, system capabilities, nmap-scan, config
• Activity-panel UI test suite

Checklist

• bun turbo typecheck passes
• Tested locally with at least one LLM provider
• PR is focused on a single change
• No secrets, credentials, or API keys in the diff
• Breaking changes are documented (if any)

• Fixes feat: add live security workbench and managed Kali deployment #1