Implement WP-0009-T04: Control Plane interactive UI on whynot-design

Builds the Control Plane's browser UI (login, dashboard, Phase
registration, Development Credit entry/proposal/review, credential
admin, audit log) as a FastAPI + Jinja2 app over the already-finished
T03 backend, rather than from scratch — whynot-design's Lit web
components are vendored as static assets (source commit 4b62cffc,
v0.4.1), with lit itself resolved via an esm.sh CDN import map.

Session auth re-checks the credential token against the database on
every request rather than trusting the session cookie's cached rights,
so a mid-session revocation takes effect immediately.

9 new Docker-gated HTTP-level tests via FastAPI's TestClient (no
browser-automation tool available, so real rendering of the <wn-*>
components was never visually verified). All four WP-0009 tasks are
now done; workplan marked finished.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/target_revenue/registry.py

@@ -218,6 +218,22 @@ def get_phase_manifest(conn: Connection, phase_id: str) -> dict[str, Any] | None
     return row[0] if row else None
 
 
+def list_phase_manifests_for_licensor(conn: Connection, licensor_id: str) -> list[dict[str, Any]]:
+    """All Phases registered by one Licensor tenant, most recently
+    registered first — needed by any UI that wants to show "my Phases"
+    (WP-0009-T04's Control Plane dashboard) rather than requiring a
+    caller to already know every `phase_id` in advance."""
+    rows = conn.execute(
+        """
+        SELECT manifest FROM phase_manifests
+         WHERE licensor_id = %s
+         ORDER BY registered_at DESC
+        """,
+        (licensor_id,),
+    ).fetchall()
+    return [row[0] for row in rows]
+
+
 def register_extension(
     conn: Connection, licensor: Licensor, extension: dict[str, Any]
 ) -> None: