fix(master): review fixes for the Ledger UI (#18)

- icons/gen writes to the current directory so `go generate
  ./internal/master/web/icons` works (output verified byte-identical)
- share the registry-host check as imageref.IsRegistryHost (with test)
- agents fragment refreshes the "N machines" header count out of band
- ignore the saved machine filter at <=760px where the machine list is hidden
- aria-current on the active machine filter link, aria-pressed on theme toggle
- CLAUDE.md: icons package, SSE ping event, swarm_cluster_id

Claude-Session: https://claude.ai/code/session_01GAZsp3P7Qto6JnhipxWUJQ

internal/master/web/server_test.go

@@ -346,6 +346,13 @@ func TestAgentsPage_ShowsConnectionState(t *testing.T) {
 	assert.NotContains(t, body, `class="drawer"`, "the add panel is closed by default")
 }
 
+func TestAgentsFragment_RefreshesHeaderCount(t *testing.T) {
+	srv, _, _, _ := newTestServer(t)
+	code, body := get(t, srv, "/fragments/agents")
+	assert.Equal(t, http.StatusOK, code)
+	assert.Contains(t, body, `id="agents-sub" hx-swap-oob="true">3 machines`)
+}
+
 func TestAgentsPage_RevokeUsesPopover(t *testing.T) {
 	srv, _, _, _ := newTestServer(t)
 	_, body := get(t, srv, "/agents")