Console: serve the static shell past the remote session lifetime so a first visit still gets HALT #1006

On keel serve --external-host, a browser that has no cached console is refused the page itself once the 12-hour remote session lifetime (#648) expires. It never loads the client, so it never shows HALT. Its only stop is keel kill at a terminal.

#983 and #985 (PR #1001) keep HALT working past the lifetime for a console that is already loaded: the service worker serves the cached page, and the expired /api/pulse refusal carries {halt_token, resume_command} when the session cookie matches. A first visit with no service worker yet, or a browser whose cached files were cleared, never gets that far.

Proposal: serve the static shell (index.html and the static JS, CSS and icons, which contain no data and no token) past the lifetime, so the client can load and reach the expired Pulse path that #985 already handles.

Constraints

• Every /api read and write keeps the lifetime exactly as now, except the two stop exceptions (Remote session lifetime (#648) refuses HALT too: a keel serve --external-host console can't halt after 12h until restarted #983, Console: keep the HALT control on Pulse after the remote session lifetime expires (client half of #983) #985).
• No token is embedded in the shell; the halt token still comes only from the cookie-matched Pulse refusal.
• The release token stays served nowhere (Console: the HALT token served on /api/pulse also releases resume routes #968).
• Check that the shell gives nothing away to someone without the session. Today a refused page response may differ from a refused data response; decide whether serving the shell to anyone after expiry is acceptable, given a loopback server already serves it freely.
• Real-browser check with no service worker registered: the page loads, Pulse shows "Session expired" with HALT, and HALT engages.

Held question from the #985 build. The owner asked for it to be filed (2026-10-13).