HTTPS + threaded server, web console, and orchestration layer (chains/skills/agents/workflows)

Summary

Stacked on #287 (this branch carries its root-endpoint commit). Merge order: #287 first, then #288 — after #287 lands, this PR collapses to its own 10 commits.

TLS + threaded HTTP server

• Serves HTTPS on :8888 with self-signed cert material under ~/.hexstrike/certs/ (gitignored); plain-HTTP fallback when no cert exists; HEXSTRIKE_SSL=0 forces HTTP
• Threaded request handling so long-running scans no longer block other clients
• Dependency constraint fixes (requirements.txt: h11/httpcore/certifi/aiohttp pins) — core-dep conflicts: 0

Web console at / (templates/index.html, screenshot: assets/webui-dashboard.png)

• Self-contained dark-theme console: dashboard cards, live process monitor, tool inventory, method-aware API explorer (GET/POST/DELETE chips, JSON-body prompts, parameterized route fill)
• Orchestration panel (c7debc3): Chains / Agents / Workflows / Skills tabs — sync chain runs rendered inline (status, duration, color-coded findings, per-step output), async workflow/agent runs with 3s polling + working Cancel, requires_params prompting derived from the API, skill details; per-tab lazy load + manual refresh, 5s health cycle untouched

Orchestration layer (hexstrike_orchestration.py, engine: b68d856)

• 9 tool-chains — typed targets (domain/url/ip/image), {target}/{param.X}/{steps.NAME.f} templating, health-aware skipping of uninstalled tools, per-step status/output/findings records: recon-passive, port-scan, web-content-discovery, vuln-scan, web-audit, cve-hunt, container-audit, credential-audit, full-recon
• 6 skills, 8 agents/subagents, 3 workflows (full-pentest, web-app-audit, quick-triage) — phased with on_success gating, background execution, cooperative cancellation, run registry (200-run cap)
• 15 routes under /api/orchestration (chains run synchronously; agents/workflows async with /runs/<id> status + cancel); hydra gate requires username+password+service (e6926c5)
• 13 MCP tools in hexstrike_mcp.py — list_skills, get_skill, list_agents, get_agent, list_tool_chains, get_tool_chain, run_tool_chain, list_workflows, run_workflow, run_agent, get_orchestration_status, list_orchestration_runs, cancel_orchestration_run (tools/list = 163)
• Definitions overridable without code changes via JSON files in ~/.hexstrike/orchestration/

OpenCode-native agents (.opencode/agents/, 941ed31)

• 8 Markdown agent profiles mirroring the registry: 4 specialists (mode: all) + 4 workers (mode: subagent), each driving the MCP orchestration tools with typed-target checks and safety rails (authorized-only, passive-before-active, no credential-audit without user-supplied creds)

Docs

• README: TLS behavior + trusted-cert curl + HTTPS MCP examples with REQUESTS_CA_BUNDLE, Web UI section with screenshot, Orchestration section, OpenCode agents subsection; hexstrike-ai-mcp.json uses placeholders (no local paths)

Verification

• Server health 115/127 tools (essential: all present) over HTTPS
• Chains: port-scan success on 127.0.0.1 (rustscan → nmap, 23s); params gate returns 400 with the full required list
• Workflows: quick-triage success (wafw00f → nuclei); cancel lifecycle: cancelling → cancelled after the in-flight step drains
• MCP stdio JSON-RPC E2E: initialize → tools/list = 163 → list_skills / get_agent / run_tool_chain calls succeed
• Web UI: headless-Selenium suite passes (/tmp/opencode/webui-test/orch_test.py), screenshots reviewed; HTML well-formed, extracted JS passes node --check
• OpenCode agents: frontmatter validated against the V2 spec, names cross-checked against hexstrike_orchestration.py, every referenced MCP tool name exists in hexstrike_mcp.py