Commit the concurrent session's pending web and docs work

Not my work. These nine files sat uncommitted in the shared checkout
while another session worked on them, and the UI redesign that follows
rewrites web/src/main.tsx and web/src/style.css. Committing first means
that work is recoverable rather than overwritten.

Contents, by inspection rather than by authorship: whitespace
normalisation and edits across main.tsx, 568 added lines of style.css,
client and client test changes, the orchestra-user line in build.sh, and
docs updates to AGENTS.md, AUDIT.md, DEPLOYMENT.md and the env example.

Committed at the operator's explicit instruction.

AGENTS.md

@@ -76,6 +76,11 @@ the live herdr instance and check.
   There is no container entrypoint script — `Dockerfile.api` execs
   `/app/orchestra` directly. Neither deployed file is the repo's
   `deploy/config.example.jsonc`.
+- Browser operator accounts live in `$ORCHESTRA_DATA/auth.db`. Create or reset
+  one with `orchestra-user set -data /data -username NAME` while the API is
+  stopped, or use the authenticated Settings screen. The old
+  `ORCHESTRA_WEB_USERNAME`/`ORCHESTRA_WEB_PASSWORD_HASH` pair is accepted only
+  for a one-time import into an empty database and should then be removed.
 - Two machines in the registry: `homesrv` (192.168.1.104) and `workpc`
   (192.168.1.105), each nominally running 3 herdrs (claude/codex/opencode).
   In practice **homesrv has no local herdr running** (connection refused on