feat: opensmi serve — HTTP API daemon for remote client access

[seilk]

Background

Currently opensmi requires SSH access to the gateway server (documented in docs/SHARED_GATEWAY.md). This issue tracks the next step: an HTTP API mode where users can submit jobs from their laptops without SSH.

Target UX

# No SSH needed
opensmi --remote http://gateway:8080 job submit --auto-gpus 2 --command "python train.py"
opensmi --remote http://gateway:8080 job list

Required components

• opensmi serve --port 8080 — HTTP daemon wrapping existing job queue
• opensmi --remote <url> — client mode flag (CLI + TUI)
• User identity via auth token (no anonymous access)

Security requirements (non-negotiable)

• TLS mandatory — no plaintext command submission over HTTP
• Token or mTLS auth — no open endpoints
• Single-writer daemon for job state — prevent race conditions on concurrent submit

Prerequisite

Validate the SSH gateway pattern (docs/SHARED_GATEWAY.md) with real users first.
HTTP API scope and requirements will become clearer from that feedback.

Status

Not started. Prerequisite: user feedback from shared gateway deployments.