Show expected config status in operator UI

[cbusillo]

Refs #153

Summary

• add frontend types/API call for product environment config-status
• render a read-only expected config panel before the runtime config write form
• show runtime key and managed secret binding readiness by stable lane without values or secret IDs

Verification

• pnpm --dir frontend validate
• Browser fixture smoke at http://127.0.0.1:4195/ui/?fixtures=1 on desktop and narrow/mobile viewport

Notes

• Python ruff was not applicable to the changed TypeScript/CSS files; the frontend validator covers typecheck/build/fixture assertions.