fix(pose-fusion): expose simulated CSI source

[alloutflo]

Summary

• derive the default sensing WebSocket from the current host and adjacent published port, retaining the 8080→8765 development mapping
• keep transport connection, usable data, and provenance as separate states
• mark live only after a validated frame explicitly identifies an active hardware source
• label server simulation, offline/stale, and unverified sources distinctly
• prevent silent sockets, superseded callbacks, empty offline frames, buffered demo CSI, and demo RSSI from appearing under a live badge
• add source, lifecycle, history, and metadata regressions to the blocking PR UI job

Validation

• syntax checks for main.js, csi-simulator.js, and source-status.js
• PR UI command — 40/40 passed
• git diff --check upstream/main...HEAD

The port derivation follows the documented adjacent Docker port mapping; deployments using another mapping can still use the existing manual WebSocket URL field. The tests cover browser boundaries with WebSocket/DOM stubs, not physical hardware.

Closes #1557