AI desktop path: plain-HTML Review and Cost tabs over the Qt bridge, gate in Python

ai_sections.html pastes into the no-AI dashboard.html; ai_bridge.py adds one
ai_request slot that hands every AI contract request (incl. GET /roi) to the
review backend's dispatch(). Desktop page check reruns the web review and cost
cases plus a tampered-page gate case. Eval fixture e-pyqt-ai added.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rpa-dashboard-ai/templates/contract.md

@@ -78,6 +78,9 @@ The same endpoints and rules travel over the Qt bridge instead of HTTP:
   path above without `{API_BASE}`, `body` is a JSON string (`"{}"` when there is none).
 - Python to page: one envelope, `{event: "ai_response", data: {id, status, body}}`, with the
   same `status` and JSON `body` the web endpoint would answer.
+- Every endpoint above uses this pair, the cost page's `GET /roi` included (the page sends
+  `ai_request(id, "GET", "/roi", "{}")` and gets `{runs: [RoiRun], pricing: {source, as_of}}`
+  back as the `body`). No other AI events or slots exist.
 - `GET /runs/{job_id}/document` answers an SVG string or a URL the page can load (for
   example a `file:///` path to the PDF).