Add web server, event stream, and Rive contract

- crows serve: HTTP API, Server-Sent Events per list, web approvals
  with a 10-minute fail-safe timeout; localhost only by default
- Shared pipeline for command line and server; trust.changed events
- EVENTS.md: server/UI contract; RIVE_CONTRACT.md: data-binding spec
  for the animator (one Crow artboard for v1)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UQnSw4RRWp8uqpj3nsnnXF

README.md

@@ -16,6 +16,26 @@ ANTHROPIC_API_KEY=... ./crows run todo.txt   # real crows (Claude)
 
 Optional: `CROWS_MODEL` overrides the model. Results land in `todo.crows.md`; state lives in `.crows/`.
 
+## Web server
+
+```
+./crows serve                   # localhost:8080; API + Server-Sent Events (SSE); Ctrl-C to stop
+```
+
+The server runs the same pipeline as `crows run`, but items fly in parallel and approvals come over HTTP. `EVENTS.md` is the contract for events and the API:
+
+```
+curl -XPOST localhost:8080/api/lists -d '{"text":"- [ ] What is a crow","requester":"me"}'
+curl -N "localhost:8080/api/events?list_id=<id>"        # replays the list's events so far, then streams
+curl -XPOST localhost:8080/api/verdicts -d '{"item_id":"<id>-1","target":"triage","approve":true}'
+curl localhost:8080/api/trust
+```
+
+- Item IDs are `<list_id>-<n>`, numbered from 1 in list order.
+- Approvals left unanswered for 10 minutes count as rejected (`verdict: timeout`). `-approval-timeout` changes this for testing.
+- A flooding requester gets 429 with `message` and `cooldown_s`; any list of theirs that is still flying also gets `requester.pranked`.
+- POST bodies are capped at 64 KB. Static files are served from `./web` when that folder exists.
+
 ## How an item flies
 
 1. **Sentry** classifies it: `solo` (one crow), `split` (2–4 subtasks in parallel), or `murder` (3 crows answer independently).