refactor(dashboard): one dashboard — port billing/API keys, 301 the duplicate

Two dashboards existed and had drifted apart: root /dashboard.html (118 KB single file with
Subscription & Usage + API Keys) and /spaces/dashboard.html (34 KB shell + assets/js/dashboard-*.js).
The nginx log settles which one is real: 77.211.5.129 requests /spaces/dashboard.html and never
the root page. Tonight's fixes landed on the root page twice before that was noticed.

Neither page was a superset, so deleting outright would have lost features:
  root only      -> Subscription & Usage card, API Keys card (create/revoke/reveal)
  spaces only    -> 2FA/TOTP, change password, delete space, email change, files, logs

assets/js/dashboard-billing.js + assets/css/dashboard-billing.css (new)
  loadSubscription / loadApiKeys / cancelSubscription / createApiKey / revokeApiKey /
  copyNewApiKey / dismissNewKey + isProPlusPlan / capPlan, lifted verbatim from the root page,
  wrapped in an IIFE that re-exports the onclick handlers on window; getAuthHeaders() reads the
  modular app's localStorage.webx11_session_id; PRO_PLUS_PLANS carried over (its absence threw
  "PRO_PLUS_PLANS is not defined" and silently hid both cards on the first attempt)

spaces/dashboard.html
  the two cards inserted after the Activity Logs card, plus the css/js includes
  dashboard-auth.js showDashboard() calls loadSubscription() once the view is up

retirement
  root dashboard.html deleted (git rm); `location = /dashboard.html { return 301
  /spaces/dashboard.html$is_args$args; }` so bookmarks keep working and ?next= survives
  links repointed in ai-api.html (6), ai-course.html (3), models.html (1), newOS4 hint string
  (v4.6.146 + rebuilt bundles so the cached bundle cannot serve the old URL)

Measured (playwright, 390x844 WebView UA, agando's real session):
  subscriptionCard display block, height 315px, plan "Free", price "EUR0/mo", badge "Free",
  usage "$0.00 / inf", API-keys card hidden for a free plan, 0 console warnings
  /dashboard.html?next=/skills.html -> 301 -> /spaces/dashboard.html?next=/skills.html, 200,
  login card + Telegram button present

1 files changed, 1 insertions, 1 deletions

diff --git a/modules/core/core-bundle.js b/modules/core/core-bundle.js
index 6a37d61..8b6e4cb 100644
--- a/modules/core/core-bundle.js
+++ b/modules/core/core-bundle.js
@@ -1319,7 +1319,7 @@ class OllamaManager {
             document.cookie = 'webx11_session=; path=/; max-age=0';
         } catch (e) {}
         this.terminal.print('🔒 Your login session is no longer valid on the server. ' +
-            'Open https://webx11.duckdns.org/dashboard.html , sign in with Telegram ' +
+            'Open https://webx11.duckdns.org/spaces/dashboard.html , sign in with Telegram ' +
             '(or “Sign in with a code”), then reload this page.', 'warning');
     }