Serve a local web UI from bangerd

Add a localhost-only web console so VM and image management no longer depends on the CLI for every inspection and lifecycle action.

Wire bangerd up to a configurable web listener, expose dashboard and async image-build state through the daemon, and serve CSRF-protected HTML pages with host-path picking, VM/image detail views, logs, ports, and progress polling for long-running operations.

Keep the browser path aligned with the existing sudo and host-owned artifact model: surface sudo readiness, print the web URL in daemon status, and document the new workflow. Polish the UI with resource usage cards, clearer clickable affordances, cancel paths, confirmation prompts, image-name links, and HTTP port links.

Validation: GOCACHE=/tmp/banger-gocache go test ./...

internal/system/system.go

@@ -59,6 +59,22 @@ func EnsureSudo(ctx context.Context) error {
 	return cmd.Run()
 }
 
+func CheckSudo(ctx context.Context) error {
+	if _, err := exec.LookPath("sudo"); err != nil {
+		return err
+	}
+	cmd := exec.CommandContext(ctx, "sudo", "-n", "-v")
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	if err := cmd.Run(); err != nil {
+		if stderr.Len() > 0 {
+			return fmt.Errorf("%w: %s", err, strings.TrimSpace(stderr.String()))
+		}
+		return err
+	}
+	return nil
+}
+
 func RequireCommands(ctx context.Context, commands ...string) error {
 	for _, command := range commands {
 		if _, err := exec.LookPath(command); err != nil {