Uncertainty engine: ctrl debug page for calibration snapshots

[ssilvius]

Phase 1 of the uncertainty engine spike. See docs/designs/uncertainty-engine.md.

Scope:

• New TanStack Router route in apps/ctrl: /uncertainty
• TanStack Query against GET /api/uncertainty/calibration
• Per-cohort reliability table: bucket | claimed mean | actual mean | count | orphan count | Brier
• Drop-down to filter by surface and model
• Rafters design tokens, no arbitrary values, container queries

Dependency: routes issue landed (calibration endpoint live).

Tests: .spec.ts on the table component with Zocker fixtures.

Out of scope: charts/visualizations. Phase 2 territory. Tabular data only for v1.