operator control: /cancel slash command + cancel button

new POST /api/cancel on the per-agent web UI: shells out
pkill -INT claude (procps added to harness-base.nix). emits a Note
on the bus so the operator sees the cancel landed; state goes back
to idle when run_claude wakes and emits TurnEnd as usual.

frontend:
- /cancel slash command in the terminal input
- ■ cancel turn button in the state row, visible only while
  state === 'thinking' (driven from the same SSE-based state
  machine). disabled briefly during the POST.

claude gets SIGINT (not TERM) so it flushes anything in-flight and
emits a final result row before exiting.

nix/templates/harness-base.nix

@@ -14,6 +14,9 @@
     claude-code
     bashInteractive
     coreutils-full
+    # procps for pkill — used by the web UI's /api/cancel to SIGINT the
+    # in-flight claude turn.
+    procps
   ];
 
   # Git is needed by claude's Bash tool (for the agent <-> manager config