webui: add "6. Scenario" page — run scriptable test scenarios from removable media through the normal task queue

Exposes the scenario engine (platform.System.RunScenario, added earlier)
in the web UI instead of only the `bee run` CLI: a new nav item lists every
scenarios/*.json found on mounted removable media (GET /api/scenario/list)
and runs one with a click (POST /api/scenario/run), enqueued as a normal
Task with target "scenario" — progress/logs live in Tasks like any other
SAT pack, no separate live-output UI needed.

- app.go: satRunner gains RunScenario, exportManager gains
  ListScenarioFilesOnRemovableMedia/ReadScenarioFromRemovableMedia — both
  already implemented on platform.System, just newly exposed through App.
- webui/tasks.go: taskParams.ScenarioName; runTask's "scenario" case reads
  the file from removable media, parses it, and runs it.
- webui/page_scenario.go: the page itself.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

audit/internal/app/app_install.go

@@ -14,6 +14,20 @@ func (a *App) ListRemovableTargets() ([]platform.RemovableTarget, error) {
 	return a.exports.ListRemovableTargets()
 }
 
+// ListScenarioFilesOnRemovableMedia lists scenarios/*.json found on any
+// mounted removable target (e.g. the blackbox USB stick) — see
+// platform.System.ListScenarioFilesOnRemovableMedia.
+func (a *App) ListScenarioFilesOnRemovableMedia() ([]platform.ScenarioFileOnRemovableMedia, error) {
+	return a.exports.ListScenarioFilesOnRemovableMedia()
+}
+
+// ReadScenarioFromRemovableMedia reads scenarios/<name>.json from whichever
+// mounted removable target has it — see
+// platform.System.ReadScenarioFromRemovableMedia.
+func (a *App) ReadScenarioFromRemovableMedia(name string) ([]byte, error) {
+	return a.exports.ReadScenarioFromRemovableMedia(name)
+}
+
 func (a *App) ExportLatestAudit(target platform.RemovableTarget) (string, error) {
 	if _, err := os.Stat(DefaultAuditJSONPath); err != nil {
 		return "", err