Show an honest first-load telemetry state

[seoulpro]

What changed

• Keep CPU, memory, load, and site readings unavailable until a validated SSE frame arrives.
• Mark the connection as live only after validation while retaining the last verified frame during reconnects.
• Raise muted-text contrast above the normal-text threshold and add regression coverage.
• Make CI block high- or critical-severity runtime findings and unrecognized development findings while documenting the temporary brace-expansion exception.

Why

The previous first-load placeholder looked like live telemetry when the stream was unavailable. The dashboard now distinguishes a waiting connection from measured activity.

Validation

• npm run typecheck
• npm run lint
• npm test — 40 passed
• EMBERTOP_BASE_PATH=/backoffice/embertop npm run build
• npm run audit:dependencies
• npm pack --dry-run --ignore-scripts
• Desktop 1440×900 and mobile 390×844 visual QA
• Route QA 6/6 and browser controls 4/4
• Normal live browser run: 0 console errors, 0 warnings