feat(frontend): post collected samples to /api/v1/reports (closes #53)

A Reporter beside AppState POSTs a JSON delta report of each host's
unreported, non-paused samples to the same-origin /api/v1/reports every
reportInterval (default 60s). buildReport is an exported pure function of
host state; init() runs only when #app exists, so a test can import it.
Per-host marks advance only on a delivered POST and never move backwards;
only one POST is in flight, abandoned after half the interval, so a slow
backend cannot cause re-sent samples. Failure is quiet and never blocks
probing.

The client id falls back to crypto.getRandomValues where crypto.randomUUID
is missing (plain HTTP to a non-localhost host). vite.config.js proxies
/api to 127.0.0.1:8080 for yarn dev.

Model: opus-5-5

TODO.md

@@ -42,6 +42,13 @@ latest run passes.
   `OnStop` is idempotent; and `writeTimeout` now exceeds the chi per-request
   budget so that budget is actually reachable. Dead `startupTime`, `exitCode`,
   and `cancelFunc` fields were removed
+- 2026-09-21: frontend reporting client — a `Reporter` class posts collected
+  samples to `/api/v1/reports` every `reportInterval` (default 60s) as a
+  per-host delta, with the report-building step a pure exported function of host
+  state; only one report POST is in flight at a time and it is abandoned after
+  half the interval, so a slow backend cannot cause re-sent samples or a mark
+  moving backwards; the per-browser client id works in insecure (plain-HTTP)
+  contexts; `vite.config.js` proxies `/api` to the local backend for `yarn dev`
 - 2026-09-21: backend HTTP hardening (issue #19): added `ReadHeaderTimeout` and
   `IdleTimeout` to the server, a `SecurityHeaders` middleware (HSTS, tight CSP,
   frame/sniff/referrer/permissions headers) registered before CORS, and