refactor(core): remove store global singleton, thread store explicitly

Remove store.Get()/SetGlobal()/Current. Store is now passed explicitly
to all consumers via constructor parameters and function arguments.

- TUI Model holds store field, set via InitialModel(isAdmin, store)
- monitor.StartEngine(s) and InitHistoryFromStore(s) accept store
- server.Start(cfg, s) closes over store in HTTP handlers
- main.go threads store to SSH server, TUI, monitor, server
- isKeyAllowed receives store as parameter

No more hidden dependency on package-level mutable state in store pkg.
Monitor package still uses package-level state (LiveState, etc.) — will
be encapsulated into Engine struct in Phase 7.

internal/server/server.go

@@ -148,7 +148,7 @@ type ServerConfig struct {
 	ClusterKey   string // Shared Secret for Security
 }
 
-func Start(cfg ServerConfig) {
+func Start(cfg ServerConfig, s store.Store) {
 	if cfg.ClusterKey == "" {
 		fmt.Println("WARNING: No UPKEEP_CLUSTER_SECRET set. Cluster API endpoints are unauthenticated.")
 	}
@@ -185,7 +185,7 @@ func Start(cfg ServerConfig) {
 			http.Error(w, "Unauthorized: UPKEEP_CLUSTER_SECRET required", 401)
 			return
 		}
-		data, err := store.Get().ExportData()
+		data, err := s.ExportData()
 		if err != nil {
 			log.Printf("Export failed: %v", err)
 			http.Error(w, "Export failed", 500)
@@ -209,7 +209,7 @@ func Start(cfg ServerConfig) {
 			http.Error(w, "Invalid JSON", 400)
 			return
 		}
-		if err := store.Get().ImportData(data); err != nil {
+		if err := s.ImportData(data); err != nil {
 			log.Printf("Import failed: %v", err)
 			http.Error(w, "Import failed", 500)
 			return
@@ -234,7 +234,7 @@ func Start(cfg ServerConfig) {
 			return
 		}
 		backup := importer.ConvertKuma(&kb)
-		if err := store.Get().ImportData(backup); err != nil {
+		if err := s.ImportData(backup); err != nil {
 			log.Printf("Kuma import failed: %v", err)
 			http.Error(w, "Import failed", 500)
 			return