Overview "Recent tool calls" is flooded by control_decision rows #160

Problem

The Settings Overview panel Recent tool calls shows six rows of control_decision with a blank project (—), one every 30 seconds. Real tool calls get pushed out. The rows say nothing useful: no route, no caller.

Seen in real use on the devbox with eve running as a relay service. relay audit --event control_decision shows the source:

18:26:25  ok  -  -  -  0  launch:service:eve  PUT /api/eve/passkeys  class=configure  transport=socket
18:26:55  ok  -  -  -  0  launch:service:eve  PUT /api/eve/passkeys  class=configure  transport=socket

Root cause

renderOverviewRecentToolCalls (web/src/app.js) takes the first six of state.auditEvents with no filter on event kind. Every audit event lands there, including control_decision. eve's passkey sync reports to relay every 30 s (DEFAULT_POLL_MS = 30000), and each report is an audited control-plane call. The row falls back to ev.event for the name and actor.project_name for the project, which control rows don't carry, hence control_decision —.

Fix

Filter the Overview panel to call_tool events, so it shows what its title says. The Audit tab keeps showing everything. The empty state stays "No tool calls recorded yet."

Contract

• web/src/app.js renderOverviewRecentToolCalls(): rows = state.auditEvents filtered to ev.event === 'call_tool', then the first 6. Row markup unchanged. Empty state unchanged: "No tool calls recorded yet." state.auditEvents itself is not changed; the Tool Calls tab still shows every kind.
• internal/webassets/settings.html: regenerated by go run ./web/gen, never hand-edited.
• Test cmd/relay/settings_overview_ui_test.go (new, goja, same harness as settings_audit_ui_test.go): seeded with control_decision rows newer than call_tool rows, the Overview shows the tool calls and no control_decision; seeded with only control_decision, it shows the empty state.
• Docs: docs/architecture.md Overview paragraph says "the last 6 tool calls (call_tool rows)" instead of "the last 6 audit rows". cmd/devboxverify/FEATURES.md G8 gains a "Recent tool calls" row (journey none: devboxverify has no door into the Settings webview).
• File ownership: one dev task owns all of the above.

Effort estimate: ~40k output tokens, ~2 h including build, real-app check and verify.