feat(frontend): port host identity refresh controller

[sandersonstabo]

Dependency

• Immediately follows feat(frontend): port gradient avatar #312 (agent/frontend-gradient-avatar-port-f076e93).

Scope

• Port the host identity refresh controller as a small deterministic Rust state machine.
• Preserve one shared optional snapshot, one in-flight generation, duplicate suppression, stale-result immunity, and last-good identity retention.
• Register the frontend module and its focused Bazel test target.

Exclusions

• No UI composition, transport, protocol, or backend changes.
• No ownership change: callers retain route-scoped refresh custody while the controller's load remains app-scoped.

Verification

• //modules/frontend:frontend focused jobs=1 build passed.
• //tests/frontend:host_identity_controller_test passed (2 Rust tests).
• Fresh strict Clippy passed for production and test sources.
• Root Rust format and locked/offline Cargo metadata passed.
• Exact seven-path/hash guards, clean diff/status, and Bazel shutdown passed.
• Receipt: D:/artisan-editor-gate-logs/frontend-host-identity-controller-20260829-gate2/receipt.json.

Remaining work

• Integrate the controller with native host-identity UI composition in a later dependency-aware packet.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Ports the host identity refresh controller from the legacy TypeScript into a dependency-free Rust state machine, preserving the exact refresh, duplicate-suppression, stale-result, and last-good-retention behavior.

• Adds HostIdentityState with one shared optional snapshot, one in-flight generation, and strict generation fencing.
• New HostIdentityAction outputs report admission, suppression, publish, or ignore outcomes; callers keep route-scoped refresh custody.
• Registers the module in the frontend crate and adds a deterministic state-table test covering the full transition sequence.

^{Written for commit ccdd26e. Summary will update on new commits.}