fix: count tag-matched servers in the workflows list

CLAUDE.md

@@ -190,11 +190,14 @@ it reports the count and the tags and links to Edit. Splitting the two halves
 across two screens meant a workflow's reach was decided in two places with no
 one view showing both.
 
-`web/app/(app)/workflows/[id]/page.tsx` still **duplicates the match logic in
-TypeScript** to draw the resolved count without a round trip, since the browser
-already holds the fleet. It is a second implementation of `UnionTargets` /
-`MatchesTags` and must change in the same commit as the Go one — the same shape
-of hazard as the mirrored token blocks.
+`web/lib/targets.ts` **duplicates the match logic in TypeScript** to draw the
+resolved count without a round trip, since the browser already holds the fleet.
+It is a second implementation of `UnionTargets` / `MatchesTags` and must change
+in the same commit as the Go one — the same shape of hazard as the mirrored
+token blocks. It is a shared module rather than inline in a component because
+the logic had already been written twice, and the second copy — the workflows
+list — counted `target_server_ids` alone, so a **tag-only workflow reported zero
+targets** while running fine.
 
 The server picker is a hand-built two-pane list, not `<select multiple>`: a
 native multi-select paints its selected rows with the platform highlight colour,