feat(web): add max agents field and wire research/quick CLI flags

Add Max Agents input to Run Settings section in wizard. Wire maxAgents
through POST body, sanitizeLaunch, buildArgs (CLI), and buildReplScript
(REPL /agents command). Also pass --quick and --research as CLI flags
in buildArgs for modes that support them (run/whitebox/greybox).

web/public/app.js

@@ -624,6 +624,7 @@ function renderReview() {
     { k: 'Leads selected', v: `${state.selected.size} of ${allAgents().length}${state.selected.size === 0 ? ' — auto (recon-driven)' : ''}` },
     { k: 'Custom leads', v: String(state.customLeads.length) },
     { k: 'Votes / chain / recon', v: `${$('#fieldVotes').value} / ${$('#fieldChain').value} / ${$('#fieldRecon').value}` },
+    { k: 'Max agents', v: $('#fieldMaxAgents').value || 'auto' },
     { k: 'Budget', v: budgetSummary() },
     { k: 'Egress', v: state.authz.transport || 'direct' },
     { k: 'Out-of-band', v: state.authz.oobDomain ? `*.${state.authz.oobDomain}` : 'none — blind classes stay leads' },
@@ -665,6 +666,7 @@ async function startExploitation() {
     votes: Number($('#fieldVotes').value) || 3,
     chainDepth: Number($('#fieldChain').value),
     recon: Number($('#fieldRecon').value),
+    maxAgents: Number($('#fieldMaxAgents').value) || undefined,
     quick: $('#fieldQuick') ? $('#fieldQuick').checked : false,
     research: $('#fieldResearch') ? $('#fieldResearch').checked : false,
     subscription: state.authMode === 'subscription',

web/public/index.html

@@ -551,6 +551,7 @@
           <div class="field-row">
             <div class="field-group"><label class="field-label" for="fieldVotes">Votes</label><input class="narrow" id="fieldVotes" type="number" min="1" max="9" value="3" /><div class="field-help">Models that must agree before a finding is kept.</div></div>
             <div class="field-group"><label class="field-label" for="fieldChain">Chain depth</label><input class="narrow" id="fieldChain" type="number" min="0" max="5" value="2" /><div class="field-help">How far findings get chained into attack paths.</div></div>
+            <div class="field-group"><label class="field-label" for="fieldMaxAgents">Max agents</label><input class="narrow" id="fieldMaxAgents" type="number" min="1" max="64" placeholder="auto" /><div class="field-help">Concurrent agents. Empty = harness default.</div></div>
             <div class="field-group"><label class="field-label" for="fieldRecon">Recon intensity</label>
               <select class="narrow" id="fieldRecon">
                 <option value="1">1 · quick</option>