Rebuilt the bundled local UI after the System card hardware/order fixes.

Verification:

• make build-all
• TEST_FILTER=devhost_local_ui_serves_static_and_curated_bootstrap_over_real_http luajit run.lua
• make test (1016 tests)
• Deployed the rebuilt devicecode-lua/build tree to root@172.28.100.1, restarted devicecode, and verified port 80 serves /assets/index-CmVPVK6n.js with live bootstrap hw_id=bigbox-v1-cm-2 1.0.

Narrowed /events default subscriptions so the local UI opens one read-model watch per curated local UI prefix instead of subscribing to root #.

Notes:

• /events route no longer carries { '#' }; default SSE patterns are derived from local_model.ALLOW_PREFIXES.
• Kept the system metric stream by including obs/v1/system/metric/# in the generated defaults.
• Added request-level coverage proving /events opens only those prefix watches and keeps replay=false.

Verification:

• TEST_FILTER=unit.ui luajit run.lua (103 tests)
• focused luacheck on changed route/SSE/test files
• git diff --check
• make test (1018 tests)
• make build-all
• Deployed the built tree to root@172.28.100.1, restarted devicecode, verified it is running on port 80, /api/local-ui/bootstrap responds, and /events returns 200 OK with text/event-stream.
• Sampled live /events output and confirmed no ids for denied prefixes: raw, cfg, state/ui, svc/ui, or obs/v1/ui.

Caveat:

• Full make lint still exits nonzero due to existing repo-wide warnings; the changed files are clean with focused luacheck.