merge: reconcile PR 40 with current lab

Integrate lab fff55a78 into PR #40 (cc25d5ba). Lab's modular email
backend/frontend, modular settings, split stylesheets (static/style.css
stays deleted), procfs compatibility, and request-scoped TurnContract
authority win; PR #40's routing classifiers, editor/email/task features,
and style.css changes are ported into lab's module and stylesheet homes.

Integration fixes:
- settings/api.js imports ui.js under its canonical versioned URL
- browser observations keep legacy CAPTCHA/access-block evidence
- artifact turns do not re-trigger broad-web research recovery
- env reference documents PR test-tool variables; page regenerated

PR #40 defects surfaced by lab gates and fixed here:
- web_fetch generic schema drops top-level anyOf (OpenAI contract);
  the compact preview contract still requires url or urls
- get_weather registered as a brokered network read
- new lazy editor modules precached for offline use
- SearXNG pin mirrored into GPU standalone compose files
- image model picker again skips offline endpoints

Tests updated where PR #40 changed behaviour on purpose, and PR tests
moved onto lab's document_source helpers.

static/js/settings/api.js

@@ -0,0 +1,26 @@
+// Lifted verbatim from static/js/settings.js so extracted panels can post
+// settings without importing the module they were extracted from.
+import uiModule from '../ui.js?v=20260916largetoolscroll1';
+import { invalidateSettings } from '../appConfig.js';
+
+export async function postSettings(body) {
+  try {
+    const response = await fetch('/api/auth/settings', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+      const error = new Error(response.status === 403
+        ? 'Admin access is required to change these settings.'
+        : 'Failed to save');
+      error.status = response.status;
+      if (response.status === 403) uiModule.showError(error.message);
+      throw error;
+    }
+    return response;
+  } finally {
+    invalidateSettings();
+  }
+}