feat(web-ui): explicit copilot-web start + LAN bind by default on airgapped installs

[sulthannauval]

Problem

On an airgapped site the console binds loopback, so every operator needs ssh -L 3939:127.0.0.1:3939 just to open it. The LAN opt-in exists (COPILOT_UI_HOST=0.0.0.0) but must be retyped on every start. Separately, bare copilot-web doubling as "start" reads ambiguously.

Change

• copilot-web now requires an explicit subcommand: start or stop. Bare invocation (and the old up) print usage: copilot-web start|stop and exit 2. Breaking for scripts that call the bare form; all shipped docs/installer messages updated.
• Bind address resolution in web-ui.sh: COPILOT_UI_HOST env → ~/.copilot/ui-host file → loopback (rantaiclaw default).
• setup-airgapped.sh writes 0.0.0.0 to ~/.copilot/ui-host only when the file doesn't exist, so an operator's override (echo 127.0.0.1 > ~/.copilot/ui-host) survives re-installs/updates. Airgapped console is then reachable at http://<machine-ip>:3939 with no tunnel.
• Online installs (get.sh / setup.sh) keep loopback-only.
• Start banner prints the LAN URL when bound beyond loopback; installer next-steps now list rantaiclaw setup login before first console start.

Non-goals

• No hard gate on "LAN bind without a login" — the existing warning stays. Detecting login state from shell is fragile across profiles/workspaces; noted as a possible follow-up in rantaiclaw itself.
• No change to rantaiclaw ui start or gateway bind (gateway stays loopback; console proxies to it).

Risk & rollback

• Risk: airgapped installs widen the console's reachability from loopback to LAN by default. Deliberate and requested for the airgapped deployment model; login is warned about at install and start. Console has full agent control — flagged in README.
• Rollback: revert this commit; on an installed host, echo 127.0.0.1 > ~/.copilot/ui-host restores loopback immediately without reinstalling.

Validation

• bash -n on all touched scripts (shellcheck runs in CI).
• Sandboxed stub tests: env > file > loopback precedence, start/stop/bare/up dispatch, LAN banner URL.
• Sandboxed installer run ×3: first install writes 0.0.0.0, re-install preserves operator's 127.0.0.1, messages correct.
• tests/installer-matrix.sh 61 passed, tests/bundle-consistency.sh 23 passed (local rantaiclaw 0.18.3-alpha).