feat(app,ui): Dashboard view + list-first read-op scheduler (Фаза 2, Этап 5)

[temrjan]

Summary

• Dashboard — the third view and the new home after PIN-unlock (Gate-1 ratification, the Phase-2 plan's letter): per-chain balance (from context, humanized via wei_to_eth), DeFi positions (the client side of the §3.8 positions op), and the "Waiting for you: N" block. The activity strip deliberately does not exist until Stage 7 — no stubs.
• Read-op scheduler (the stage's core) — the normative list-first policy from canon §3.8 + the Reviewer's Gate-1 flag: a read-op (positions | context refresh, alternating, ~30 s cadence) goes out ONLY right after a fresh list reply — never from a tick, never ahead of a parked user intent (flush_pending first), never with a card open or a card request in flight; entering the dashboard marks the data stale. Honest limit documented in-code: a hung read-op stalls polling with it (no server timeout by canon) — the risk class accepted for context since Stage 2.
• Honest degradations: positions are a tri-state (loading ≠ unavailable ≠ empty); a failed balance refresh keeps the old data but flags it "may be stale"; positions that do not fit end with an explicit "+N more" marker — the overflow budget counts loop rows only (Gate-2 blocker: the header was subtracted twice, hiding rows that fit; pinned by an exact-boundary test with a red-proof).
• Asset addresses are not rendered on the dashboard (Gate-1 №4); extra values render verbatim ("∞", "80%") — display strings by canon, never parsed.
• Protocol/transport are additive (Request::Positions, tri-state outcome); hello stays proto 2. Exactly 5 test helpers gained an explicit switch to Queue — zero existing tests rewritten.

Spec: .claude/specs/2026-07-13-console-v2-phase2-s5-dashboard.md
Report (incl. Gate-2 delta): .claude/reports/2026-07-13-console-v2-phase2-s5-dashboard.md

Test plan

• cargo test — 184 + 19 + 1 green (+29 over main)
• cargo clippy --all-targets -- -D warnings, cargo fmt --check, cargo deny check — clean
• Red mutations proven — 8 total, each dropping exactly its own test: list-first off, view gate off, staleness gate off, dashboard-entry stale-mark off, context_stale off, home back to Queue, read-op born from a tick, the buggy overflow formula restored (the Gate-2 blocker — cut 11 of 15 fitting rows)
• DoD smoke: real binary in a pty against a proto-2 stub with the canonical Aave fixture — 10/10 (home=Dashboard after PIN, three tabs, "chain 1 0.01 ETH", "aave_v3 1000 USD", "∞"/"80%" verbatim on screen, navigation, exit 6, stdout clean)
• Reviewer Gate-2: fleet + /security-review — 1 blocker (overflow budget, algebra re-verified by the Reviewer by hand both before and after the fix) + 2 minors, all fixed in-round; delta verdict «чисто»