feat: add "Create Spec" button and fix Windows asyncio subprocess

UI Changes:
- Add "Create Spec with AI" button in empty kanban when project has no spec
- Button opens SpecCreationChat to guide users through spec creation
- Shows in Pending column when has_spec=false and no features exist

Windows Fixes:
- Fix asyncio subprocess NotImplementedError on Windows
- Set WindowsProactorEventLoopPolicy in server/__init__.py
- Remove --reload from uvicorn (incompatible with Windows subprocess)
- Add process cleanup on startup in start_ui.bat

Spec Chat Improvements:
- Enable full tool access (remove allowed_tools restriction)
- Add "user" to setting_sources for global skills access
- Use bypassPermissions mode for auto-approval
- Add WebFetch/WebSearch auto-approve hook

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

security.py

@@ -309,6 +309,28 @@ def get_command_for_validation(cmd: str, segments: list[str]) -> str:
     return ""
 
 
+async def web_tools_auto_approve_hook(input_data, tool_use_id=None, context=None):
+    """
+    Pre-tool-use hook that auto-approves WebFetch and WebSearch tools.
+
+    Workaround for Claude Code bug where these tools are auto-denied in dontAsk mode.
+    See: https://github.com/anthropics/claude-code/issues/11881
+
+    Args:
+        input_data: Dict containing tool_name and tool_input
+        tool_use_id: Optional tool use ID
+        context: Optional context
+
+    Returns:
+        Empty dict to allow (auto-approve)
+    """
+    tool_name = input_data.get("tool_name", "")
+    if tool_name in ("WebFetch", "WebSearch"):
+        # Return empty dict = allow/approve the tool
+        return {}
+    return {}
+
+
 async def bash_security_hook(input_data, tool_use_id=None, context=None):
     """
     Pre-tool-use hook that validates bash commands using an allowlist.