feat(console): add runtime management and WIT Registry

- embed wasmeld-runtime behind an Axum management API
- persist service metadata, metrics, and events with Toasty and libSQL
- register immutable component artifacts with platform-owned limits
- publish, list, inspect, and download binary WIT package versions
- verify Runtime lifecycle, persistence, Registry immutability, and transitive fetch

crates/wasmeld-console/src/main.rs

@@ -0,0 +1,65 @@
+//! Standalone Wasmeld management server entry point.
+
+use std::{env, net::SocketAddr, path::PathBuf, sync::Arc};
+
+use axum::http::HeaderValue;
+use tracing::info;
+use tracing_subscriber::EnvFilter;
+use wasmeld_console::{Console, ConsoleConfig, app};
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| EnvFilter::new("wasmeld_console=info")),
+        )
+        .init();
+
+    let address = env::var("WASMELD_ADDR")
+        .unwrap_or_else(|_| "127.0.0.1:8080".to_owned())
+        .parse::<SocketAddr>()?;
+    let artifact_dir = env::var_os("WASMELD_ARTIFACT_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| PathBuf::from("var/wasmeld/components"));
+    let database_path = env::var_os("WASMELD_DATABASE_PATH")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| PathBuf::from("var/wasmeld/console.db"));
+    let wit_registry_dir = env::var_os("WASMELD_WIT_REGISTRY_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| PathBuf::from("var/wasmeld/wit-packages"));
+    let allowed_origins = allowed_origins()?;
+    let console = Arc::new(
+        Console::new(ConsoleConfig {
+            artifact_dir,
+            database_path,
+            wit_registry_dir,
+            ..ConsoleConfig::default()
+        })
+        .await?,
+    );
+    let application = app(console, allowed_origins);
+    let listener = tokio::net::TcpListener::bind(address).await?;
+
+    info!(%address, "Wasmeld listening");
+    axum::serve(listener, application)
+        .with_graceful_shutdown(shutdown_signal())
+        .await?;
+    Ok(())
+}
+
+fn allowed_origins() -> Result<Vec<HeaderValue>, Box<dyn std::error::Error>> {
+    let value = env::var("WASMELD_ALLOWED_ORIGINS")
+        .unwrap_or_else(|_| "http://localhost:3000,http://127.0.0.1:3000".to_owned());
+    value
+        .split(',')
+        .filter(|origin| !origin.trim().is_empty())
+        .map(|origin| origin.trim().parse::<HeaderValue>().map_err(Into::into))
+        .collect()
+}
+
+async fn shutdown_signal() {
+    if tokio::signal::ctrl_c().await.is_err() {
+        tracing::warn!("failed to install Ctrl+C handler");
+    }
+}