mavweb: add /history page for command history

- New /history route displays recent facts in a dedicated page with
  voided-row styling (line-through + opacity + badge).
- Navigation link added to /dash page header.
- Handler calls core.RecentFacts(ctx, 200) and renders historyTmpl.

cmd/mavweb/main.go

@@ -45,6 +45,9 @@ var staticFiles embed.FS
 //go:embed dash.html
 var dashHTML string
 
+//go:embed history.html
+var historyHTML string
+
 // dashTmpl — the monitoring read surface, server-rendered from dash.html (no JS,
 // no client fetch); meta-refresh keeps it live. html/template escapes the user
 // text in facts/nudges. Read-only: browses the append-only store via CoreAPI,
@@ -127,6 +130,9 @@ func main() {
 	mux.HandleFunc("/dash", func(w http.ResponseWriter, r *http.Request) {
 		handleDash(w, r, core)
 	})
+	mux.HandleFunc("/history", func(w http.ResponseWriter, r *http.Request) {
+		handleHistory(w, r, core)
+	})
 	// ----- passkey (WebAuthn) endpoints -----
 	// Wired when both -core and a configured origin are present. The origin
 	// must match the browser's view of mavweb (e.g. https://maven.kvmx.ru).
@@ -357,6 +363,28 @@ input[type=text]{width:22rem}code{background:#f4f4f4;padding:.1rem .3rem}
 {{else}}<p>none enabled.</p>{{end}}
 `
 
+var historyTmpl = template.Must(template.New("history").Parse(historyHTML))
+
+func handleHistory(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
+	if core == nil {
+		http.Error(w, "history disabled (no -core)", http.StatusServiceUnavailable)
+		return
+	}
+	ctx := r.Context()
+	facts, err := core.RecentFacts(ctx, 200)
+	if err != nil {
+		log.Printf("history: %v", err)
+		http.Error(w, "core read failed", http.StatusBadGateway)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := historyTmpl.Execute(w, struct {
+		Facts []ipc.Fact
+	}{facts}); err != nil {
+		log.Printf("history render: %v", err)
+	}
+}
+
 // handleTools serves the enable surface (GET) and applies an enable (POST).
 // POST fields: name, cmd (space-separated argv), destructive (checkbox). cmd is
 // whitespace-split — argv with embedded spaces isn't supported (ponytail: no