merge: reconcile PR 40 with current lab

Integrate lab fff55a78 into PR #40 (cc25d5ba). Lab's modular email
backend/frontend, modular settings, split stylesheets (static/style.css
stays deleted), procfs compatibility, and request-scoped TurnContract
authority win; PR #40's routing classifiers, editor/email/task features,
and style.css changes are ported into lab's module and stylesheet homes.

Integration fixes:
- settings/api.js imports ui.js under its canonical versioned URL
- browser observations keep legacy CAPTCHA/access-block evidence
- artifact turns do not re-trigger broad-web research recovery
- env reference documents PR test-tool variables; page regenerated

PR #40 defects surfaced by lab gates and fixed here:
- web_fetch generic schema drops top-level anyOf (OpenAI contract);
  the compact preview contract still requires url or urls
- get_weather registered as a brokered network read
- new lazy editor modules precached for offline use
- SearXNG pin mirrored into GPU standalone compose files
- image model picker again skips offline endpoints

Tests updated where PR #40 changed behaviour on purpose, and PR tests
moved onto lab's document_source helpers.

tests/test_tool_routing_experiment.py

@@ -52,7 +52,7 @@ def test_web_subject_followup_does_not_offer_shell_or_private_stores():
     assert capabilities == {'search_browser'}
     assert result.offered
     assert {schema.rsplit('__', 1)[-1] for schema in result.offered} <= {
-        'web_search', 'web_fetch', 'private_browser', 'youtube_tool',
+        'web_search', 'web_fetch', 'get_weather', 'private_browser', 'youtube_tool',
         'search_hf_models', 'pdf_extract',
     }
     assert not result.offered.intersection({
@@ -460,7 +460,7 @@ async def test_experiment_request_uses_compact_tools_auto_choice_and_no_thinking
                                    message='List my notes')
     contract = select_experiment_inventory(inventory, routed, [], mode)
     _ = [chunk async for chunk in preview.stream_preview(
-        endpoint_url='http://test', model='test', messages=[{'role': 'user', 'content': 'Hi'}],
+        endpoint_url='http://test', model='test', messages=[{'role': 'user', 'content': 'List my notes'}],
         headers={}, turn_contract=contract, session_id='test', owner='test',
         disabled_tools=set(), tool_policy=policy,
     )]