feat(observer): M-Obs 4-7 — widgets, dashboard, docs, integration example

M-Obs 4: @shade/widgets React library
- ShadeProvider context with observer URL + token + theme
- useShadeState (polling) + useShadeEvents (SSE) hooks
- 7 widgets: IdentityCard, SessionList, PrekeyStock, RecentActivity,
  ServerStatus, FingerprintCompare, WidgetCatalog (meta-widget for
  user-selectable layout with localStorage persistence)
- Self-contained CSS via inline styles, no external CSS conflicts
- Light/dark/auto theme via tokens

M-Obs 5: @shade/dashboard standalone SPA
- Vite + React app composing all widgets into a full debugger layout
- Login screen with token persistence to localStorage
- Build script copies dist/ to @shade/observer/dist/ for embedded serving
- 211 KB JS bundle (66 KB gzipped)

M-Obs 6: Documentation + integration example
- READMEs for @shade/observer and @shade/widgets
- examples/06-observer-dashboard runnable demo: spins up prekey server +
  observer, runs Alice ↔ Bob conversation loop, dashboard at :3901
- Updated root README and docker-compose.yml with observer integration

M-Obs 7: End-to-end verification
- StateAggregator now drains buffered events on subscription, so
  identity.initialized fires before observer construction are still seen
- Verified live: snapshot endpoint returns full state, dashboard serves,
  401 without auth, sessions/messages/ratchet steps all tracked

220 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

README.md

@@ -13,6 +13,7 @@ End-to-end encryption library implementing the Signal Protocol (X3DH + Double Ra
 - **Constant-time comparisons** and **memory zeroization** for hardened operation
 - **Binary wire format** that's significantly smaller than JSON
 - **Crash-safe** — sessions survive container restarts, power outages, SIGKILL
+- **Live observability** — bundled dashboard SPA + embeddable React widgets to see what's happening between every step
 
 ## Quick start
 
@@ -68,13 +69,16 @@ const plaintext = await manager.decrypt('alice', incomingEnvelope);
 
 | Package | Purpose |
 |---------|---------|
-| `@shade/core` | Protocol logic (X3DH, Double Ratchet, session manager, errors) |
+| `@shade/core` | Protocol logic (X3DH, Double Ratchet, session manager, errors, events) |
 | `@shade/crypto-web` | SubtleCrypto + @noble/curves provider, in-memory storage |
 | `@shade/storage-sqlite` | Persistent SQLite storage (zero-config, bun:sqlite) |
 | `@shade/storage-postgres` | PostgreSQL storage with Drizzle for shared databases |
 | `@shade/server` | Prekey server (Hono routes, auth, rate limit, health, metrics) |
 | `@shade/transport` | HTTP + WebSocket transport wrappers with auto-encryption |
 | `@shade/proto` | Compact binary wire format (smaller than JSON) |
+| `@shade/observer` | Live debugger backend (snapshot, SSE, dashboard) — see [README](./packages/shade-observer/README.md) |
+| `@shade/widgets` | Embeddable React widgets — see [README](./packages/shade-widgets/README.md) |
+| `@shade/dashboard` | Standalone dashboard SPA bundled into the observer |
 
 ## Security properties