fix(monitoring): wire project Monitoring tab + reconcile phase-5 placeholders

[Copxer]

Phase 5 just shipped its first spec (023 — website monitor MVP), but the codebase still referenced "Phase 5 — coming soon" in several places where the underlying functionality now exists. Plus a small dev-server self-probe deadlock warning that came up while testing 023 against a cloudflared tunnel pointing at the same Nexus instance. Non-spec follow-up branch.

Summary

• Project Monitoring tab — ProjectController::show now exposes projectMonitors; Projects/Show.vue flips the monitoring tab pendingPhase to null and renders a real panel with status badges + "Add monitor" / "Browse all" CTAs.
• Self-probe warning on the Create form — fires when the entered URL hostname matches window.location.hostname. Non-blocking hint nudges the user to --workers=4 or a different URL since php artisan serve's single worker deadlocks when a probe loops back through cloudflared. Plus a new "Tip: monitor /up" hint under the URL field — Laravel ships /up as the framework health endpoint and it's the right URL to monitor.
• Command palette: three entries graduated from disabled → real run: go-issues-prs (Phase 2 ✅), go-deployments (Phase 4 ✅), go-monitoring (Phase 5 ✅). go-pipelines's stale "Phase 4" pin became a generic "Soon" since Phase 4 shipped Deployments and Pipelines hasn't been spec'd.
• Welcome.vue: dropped the "— coming with phase 5" qualifier from the Website performance feature card.
• Extracted @/lib/websiteStyles.ts — three consumers (Index, Show, project-tab Monitoring) now share websiteStatusTone, mirroring the workflowRunStyles.ts pattern from the previous project-tabs fix. The next time WebsiteStatus gains a case, only one file changes.

Test plan

• vendor/bin/pint --test passes.
• php artisan test — 1 net new passing test (test_show_scopes_monitors_to_this_project); existing test_show_renders_the_project extended with a has('projectMonitors') assertion. Full suite 312 passed (was 310). The 50 failures are env-only POST CSRF (419) baseline; CI passes them.
• npm run build clean.
• Manual smoke (post-merge): open /projects/{slug}, click Monitoring tab → see the project's monitors with status badges; click Add monitor → URL field shows /up hint + self-probe warning when typing a self-loop URL; ⌘K → Issues / Deployments / Monitoring entries are now active.

Self-review notes

Self-review pass via superpowers:code-reviewer; addressed both substantive recommendations:

• Extracted websiteStyles.ts — reviewer flagged this as the third consumer (the threshold for extraction per the workflowRunStyles precedent).
• Reconciled go-pipelines stale label — was pinned to "Phase 4" even though Phase 4 fully shipped; now reads generic "Soon" since the Pipelines surface (CI-only filter view of workflow runs) hasn't been spec'd. Doing it here keeps the PR's "reconcile stale phase references" theme coherent.

Phase 1 caveats deliberately left:

• Same-host different-port false positives on the self-probe warning (e.g. Vite at :5173 vs Laravel at :8000). The warning surfaces in that case too even though the deadlock is Laravel-only. Cheap (it's just a hint), so the false-positive rate is acceptable.
• Cross-tenant scope — projectMonitors uses where('project_id', $project->id) without an additional owner check. Matches the existing repository / activity / deployments scoping on the project show page; uniform fix when teams ship.
• Pipelines surface still has both a sidebar entry (disabled: true, soonLabel: 'Phase 4' — still pinned to Phase 4 in the sidebar) and a command palette entry (now generic "Soon"). The sidebar inconsistency is an honest stale carryover but felt out-of-scope for this fix; flag for a future small chore/ PR if it bothers anyone.