merge: reconcile PR 40 with current lab

Integrate lab fff55a78 into PR #40 (cc25d5ba). Lab's modular email
backend/frontend, modular settings, split stylesheets (static/style.css
stays deleted), procfs compatibility, and request-scoped TurnContract
authority win; PR #40's routing classifiers, editor/email/task features,
and style.css changes are ported into lab's module and stylesheet homes.

Integration fixes:
- settings/api.js imports ui.js under its canonical versioned URL
- browser observations keep legacy CAPTCHA/access-block evidence
- artifact turns do not re-trigger broad-web research recovery
- env reference documents PR test-tool variables; page regenerated

PR #40 defects surfaced by lab gates and fixed here:
- web_fetch generic schema drops top-level anyOf (OpenAI contract);
  the compact preview contract still requires url or urls
- get_weather registered as a brokered network read
- new lazy editor modules precached for offline use
- SearXNG pin mirrored into GPU standalone compose files
- image model picker again skips offline endpoints

Tests updated where PR #40 changed behaviour on purpose, and PR tests
moved onto lab's document_source helpers.

tests/test_browser_observation.py

@@ -3,6 +3,15 @@ import json
 from src.clean_agent_preview import preview_tool_result_text
 
 
+def test_legacy_page_text_retains_access_block_evidence():
+    result = {'url': 'https://example.org', 'title': 'Security verification',
+              'text': 'Unusual traffic. Complete the CAPTCHA.'}
+    output = preview_tool_result_text({'output': json.dumps(result), 'exit_code': 0},
+                                     'private_browser', {})
+    assert 'Security verification' in output
+    assert 'Complete the CAPTCHA' in output
+
+
 def test_snapshot_survives_large_duplicate_refs():
     result = {'refs': {f'e{i}': {'name': 'noise' * 50} for i in range(1000)},
               'origin': 'https://example.org',