herdr phase 3: INFRA tier Herdr sessions surface

New INFRA category "Herdr sessions" (purple sparkles icon between
Fleet and Local hardware). Shows a card per online fleet node with:

  - Node name + hostname + IP
  - Per-workspace agent state pills (working / blocked / done /
    idle / unknown), colored dots + pane count
  - "Open" button → renders that node's full Herdr TUI inline via
    xterm.js (same nodeHerdrConnector + WebRTC-with-fallback the
    MissionCanvas Live Pane uses)

Backend:
  - node daemon: herdr_workspaces + herdr_snapshot ops
    (`herdr workspace list`, `herdr api snapshot`)
  - fleet_herdr::snapshot helper on top of hub.call_timeout
  - GET /api/nodes/{id}/herdr/session route

Fetch flow: /api/nodes filtered to status='online' → for each,
/api/nodes/{id}/herdr/session in parallel. Snapshot errors surface
per-card without failing the whole grid.

The "Open" xterm is separate from the MissionCanvas Live Pane —
this one is scoped to the whole node's Herdr TUI (any workspace),
not a specific mission's pane. Operator toggles between nodes via
the buttons.

Verified: cargo check --workspace + tsc --noEmit both green.

crates/bins/clawmates-node/src/main.rs

@@ -509,7 +509,11 @@ async fn handle_frame(
         // polls that pane's agent_status; `herdr_read` scrapes its recent
         // transcript. Node just shells out to the `herdr` binary — the
         // Herdr background daemon is expected to already be running.
-        op @ ("herdr_dispatch" | "herdr_status" | "herdr_read") => {
+        op @ ("herdr_dispatch"
+        | "herdr_status"
+        | "herdr_read"
+        | "herdr_workspaces"
+        | "herdr_snapshot") => {
             if let Some(id) = v.get("id").and_then(Value::as_u64) {
                 let (ok, output) = herdr_op(op, &v).await;
                 let _ = out.send(
@@ -1043,6 +1047,8 @@ async fn herdr_op(op: &str, v: &Value) -> (bool, String) {
             ])
             .await
         }
+        "herdr_workspaces" => run(vec!["workspace".into(), "list".into()]).await,
+        "herdr_snapshot" => run(vec!["api".into(), "snapshot".into()]).await,
         _ => (false, format!("unknown herdr op {op}")),
     }
 }