feat: edit target servers and tags together in the workflow modal

CLAUDE.md

@@ -183,12 +183,24 @@ are **not** filtered out — the dispatcher already answers 503 per server, and
 patch run that silently omits an unreachable machine is worse than one that
 visibly fails on it.
 
-`web/app/(app)/workflows/[id]/page.tsx` **duplicates that match logic in
+**Both halves of the selector are edited in `EditWorkflowModal`** — the named
+servers in a `DualListBox`, the tag rows directly beneath it — and saved
+together by one `updateWorkflow`. The designer's Targets panel is **read-only**:
+it reports the count and the tags and links to Edit. Splitting the two halves
+across two screens meant a workflow's reach was decided in two places with no
+one view showing both.
+
+`web/app/(app)/workflows/[id]/page.tsx` still **duplicates the match logic in
 TypeScript** to draw the resolved count without a round trip, since the browser
 already holds the fleet. It is a second implementation of `UnionTargets` /
 `MatchesTags` and must change in the same commit as the Go one — the same shape
 of hazard as the mirrored token blocks.
 
+The server picker is a hand-built two-pane list, not `<select multiple>`: a
+native multi-select paints its selected rows with the platform highlight colour,
+which cannot be restyled across browsers and lands outside the token palette on
+a dark ground.
+
 ### Monitors
 
 HTTP, TCP, ICMP and TLS checks. Each monitor has a `runner`: `"server"` (executed by the server-side scheduler) or a `server_id` (pushed to that agent, which runs it locally and reports results). Consecutive failures beyond `retries` flip state to `down`, open an `Incident`, and notify. Hourly `Rollup` documents back the uptime graphs.