Factory pages on a phone and over the tailnet #61

Outcome

From a phone, or any machine on the tailnet, a person can open the fork's own web UI, see the factory's runs and attention items, and stop a run or pause claims.

Acceptance criteria

• The Factory pages (Factory page in the T3 web app #28) and the factory settings page (Factory settings page: edit the machine config at /settings/factory #55) work at 375 px wide: no horizontal page scroll, controls at least 44 px tall, and the run list switches to stacked cards below 640 px. Component tests render each page at 375 px and 1280 px.
• Every factory API call in apps/web/src/factory/ goes through the connected environment's HTTP base and credentials, the same way T3's own HTTP calls do. Calls are not made to the page's own origin. A test with a remote environment (a different HTTP base) proves the request goes to that base with that environment's credential.
• The fork server, reached over the tailnet (t3 serve on the fork binary with Tailscale), serves the Factory pages to a newly paired browser. factory/README.md "Remote" gives the steps: pair, open /factory, add to the home screen.
• Attention items (Needs attention: keep a list of what needs a person and notify on the Mac #58) show at the top of /factory on narrow screens.
• One integrated pass on a real phone browser over Tailscale. The PR includes screenshots of /factory, a run, and /settings/factory.

Depends on

• Factory HTTP API for status, runs and control #27
• Factory page in the T3 web app #28
• Factory settings page: edit the machine config at /settings/factory #55

Notes

This issue is for the fork's own factory, after the handover in #21. Leave it at factory:proposed until the fork's factory watches this repo.

Settled choices:

• No native mobile screen. The T3 mobile app on phones is upstream's App Store build, so it never contains fork code. A native factory screen needs the fork to build and ship its own mobile app (EAS, signing, store or TestFlight). That is a separate decision with its own cost, not part of this issue.
• app.t3.codes is upstream's hosted web, so it has no Factory page. Remote use is the fork server's own served web.
• Remote auth is T3's (Factory route layer behind T3's authentication #57): pairing, relay and tunnel sessions, with no factory-specific token.

Reference

• Design: factory/docs/design.md in this repo.
• Upstream's AGENTS.md applies. Run only the tests and typechecks for the paths you touch (vp test run <path>, vp run --filter t3 typecheck), never the repo-wide checks.
• Edit no upstream file that is not listed in factory/SEAMS. A new seam needs a line in factory/SEAMS and a reason in the PR body.