feat: web SPA bind — add 'combined' (:8392) both-plane option as default

The bind dropdown offered only memory/affect single-plane binds; #18's
composite endpoint (:8392, both planes in one session) was never reachable
from the SPA. Add 'combined' as the default-selected option, keeping
memory-only / affect-only for single-plane isolation diagnostics.

- endpoint_for_plane: combined -> :8392 (sessions.py)
- web server: accept bifrost_plane="combined" (server.py)
- dropdown: combined (:8392) default-selected, single-plane retained (index.html)
- #17 contract: endpoint_for_plane FN + plane-selector spec updated to combined
- tests: endpoint_for_plane combined, server combined bind -> :8392, dropdown default

Suite 506 green. Live-verified on :8765 (current code).

tests/test_sessions.py

@@ -384,6 +384,13 @@ class TestEndpointForPlane:
             == "http://10.100.10.50:8390"
         )
 
+    def test_combined_plane_maps_to_8392(self) -> None:
+        """combined [#18 composite]: 'combined' → http://<host>:8392 (POST-001)."""
+        assert (
+            endpoint_for_plane("combined", "10.100.10.50")
+            == "http://10.100.10.50:8392"
+        )
+
     def test_unknown_plane_raises_value_error(self) -> None:
         """unknown_plane [adversarial]: any other plane → ValueError (PRE-001)."""
         with pytest.raises(ValueError):