Phases 0-1 + Sprint A: module split, CLI layer, org-refresh fix, hygiene

- LICENSE (MIT) + README truth-pass; docs/cli.md CLI contract
- CLI subcommands (src/cli_cmds/) per "TUI for users, CLI for users+AI"
- Hub/detail refactor: keymap dispatch, modal split, action enum, BgMsg bus
- Fix: org repos were never refreshed (owner==username match); refresh now
  parallel — 49 repos in ~11s, surfaced 70 previously invisible PRs
- Fix: 3 date bugs in detail/git.rs (format-local, Local::now, 1y month math)
- Stash indicator + [m] actions, session persistence, gh CLI token fallback
- Legacy UI modules removed; plan/ docs (roadmap, audit, debate, handoff)

src/util/url.rs

@@ -1,7 +1,14 @@
+//! Converts git remote URLs (SSH or HTTPS) into the browser-facing web URL
+//! for the same repo, used by every "open in browser" action.
+
+/// Rewrites `git_url` (`git@host:owner/repo.git` or an HTTPS clone URL) into
+/// `https://host/owner/repo`. Already-HTTPS URLs are returned with just the
+/// `.git` suffix trimmed; anything that doesn't look like either form is
+/// returned unchanged rather than guessed at.
 pub fn to_web_url(git_url: &str) -> String {
     if git_url.starts_with("http") { return git_url.trim_end_matches(".git").to_string(); }
     if let Some(colon) = git_url.rfind(':') {
-        let host = git_url[..colon].split('@').last().unwrap_or("");
+        let host = git_url[..colon].split('@').next_back().unwrap_or("");
         let path = git_url[colon + 1..].trim_end_matches(".git");
         return format!("https://{}/{}", host, path);
     }