merge: reconcile PR 40 with current lab

Integrate lab fff55a78 into PR #40 (cc25d5ba). Lab's modular email
backend/frontend, modular settings, split stylesheets (static/style.css
stays deleted), procfs compatibility, and request-scoped TurnContract
authority win; PR #40's routing classifiers, editor/email/task features,
and style.css changes are ported into lab's module and stylesheet homes.

Integration fixes:
- settings/api.js imports ui.js under its canonical versioned URL
- browser observations keep legacy CAPTCHA/access-block evidence
- artifact turns do not re-trigger broad-web research recovery
- env reference documents PR test-tool variables; page regenerated

PR #40 defects surfaced by lab gates and fixed here:
- web_fetch generic schema drops top-level anyOf (OpenAI contract);
  the compact preview contract still requires url or urls
- get_weather registered as a brokered network read
- new lazy editor modules precached for offline use
- SearXNG pin mirrored into GPU standalone compose files
- image model picker again skips offline endpoints

Tests updated where PR #40 changed behaviour on purpose, and PR tests
moved onto lab's document_source helpers.

tests/test_image_research_settings_static.py

@@ -1,21 +1,29 @@
 from pathlib import Path
+from tests.helpers.stylesheets import app_css
 
 
 ROOT = Path(__file__).resolve().parents[1]
 
 
 def test_image_settings_only_list_online_served_image_models():
-    settings = (ROOT / "static/js/settings.js").read_text(encoding="utf-8")
+    # The image panel moved into static/js/settings/imageModels.js; read the
+    # whole settings surface so this pins behaviour rather than a filename.
+    settings = "\n".join(
+        p.read_text(encoding="utf-8")
+        for p in [ROOT / "static/js/settings.js", *sorted((ROOT / "static/js/settings").glob("*.js"))]
+    )
 
     assert "fetch('/api/model-endpoints'" in settings
     assert "!endpoint.is_enabled || !endpoint.online" in settings
-    assert "endpoint.model_type || '').toLowerCase() !== 'image'" in settings
+    # Image capability is decided per model, so image models served from a
+    # general endpoint (for example gpt-image-1) are listed too.
+    assert "modelCaps(modelId, '', endpoint.model_type).gen" in settings
     assert "stable-diffusion-3.5-medium', 'stable-diffusion-inpainting" not in settings
     assert "(not detected)" not in settings[settings.index("async function initImageSettings"):settings.index("function syncImgDisabled")]
 
 
 def test_deep_research_fields_are_constrained_to_their_card():
-    styles = (ROOT / "static/style.css").read_text(encoding="utf-8")
+    styles = app_css()
 
     rule = styles[styles.index("/* Deep Research uses long labels"):]
     assert ".admin-card:has(#set-researchSearch) .settings-row { min-width: 0; }" in rule