merge: reconcile PR 40 with current lab

Integrate lab fff55a78 into PR #40 (cc25d5ba). Lab's modular email
backend/frontend, modular settings, split stylesheets (static/style.css
stays deleted), procfs compatibility, and request-scoped TurnContract
authority win; PR #40's routing classifiers, editor/email/task features,
and style.css changes are ported into lab's module and stylesheet homes.

Integration fixes:
- settings/api.js imports ui.js under its canonical versioned URL
- browser observations keep legacy CAPTCHA/access-block evidence
- artifact turns do not re-trigger broad-web research recovery
- env reference documents PR test-tool variables; page regenerated

PR #40 defects surfaced by lab gates and fixed here:
- web_fetch generic schema drops top-level anyOf (OpenAI contract);
  the compact preview contract still requires url or urls
- get_weather registered as a brokered network read
- new lazy editor modules precached for offline use
- SearXNG pin mirrored into GPU standalone compose files
- image model picker again skips offline endpoints

Tests updated where PR #40 changed behaviour on purpose, and PR tests
moved onto lab's document_source helpers.

tests/test_tui_round_cap.py

@@ -2,6 +2,7 @@
 
 import json
 
+from src.tool_policy import WEB_TOOL_NAMES
 from routes.chat_routes import (
     _effective_agent_rounds,
     _effective_native_output_tokens,
@@ -811,14 +812,14 @@ def test_local_network_turn_is_not_short_circuited_by_web_disabled_guard():
     context = _host_bridge_context()
     assert not _web_search_unavailable_for_turn(
         {"web", "files"},
-        {"web_search", "web_fetch"},
+        set(WEB_TOOL_NAMES),
         "Find the local IP for ajax; do not use web search.",
         context,
         None,
     )
     assert _web_search_unavailable_for_turn(
         {"web"},
-        {"web_search", "web_fetch"},
+        set(WEB_TOOL_NAMES),
         "Search the web for the latest Qwen release.",
         context,
         None,