Commit the concurrent session's pending web and docs work

Not my work. These nine files sat uncommitted in the shared checkout
while another session worked on them, and the UI redesign that follows
rewrites web/src/main.tsx and web/src/style.css. Committing first means
that work is recoverable rather than overwritten.

Contents, by inspection rather than by authorship: whitespace
normalisation and edits across main.tsx, 568 added lines of style.css,
client and client test changes, the orchestra-user line in build.sh, and
docs updates to AGENTS.md, AUDIT.md, DEPLOYMENT.md and the env example.

Committed at the operator's explicit instruction.

AUDIT.md

@@ -391,3 +391,37 @@ work.
 
 Sudo is not available in this sandbox, so the worker install, the restart, and
 the `worker.env` scrub remain operator steps.
+
+## Browser operator database and UI refresh (2026-08-26)
+
+The browser login no longer depends on an operator copying a bcrypt hash into
+deployment configuration. The live startup path in `cmd/orchestra/main.go`
+opens `$ORCHESTRA_DATA/auth.db` through `internal/authn`, refuses to serve with
+an empty operator database, and registers the database-backed session and
+account handlers before wrapping the mux with `authz.HTTPWithSessions`.
+
+- `auth.db` is an embedded bbolt database created mode 0600. Passwords are
+  bcrypt-hashed before the record is written; login also performs bcrypt for an
+  unknown username to avoid an account-existence timing shortcut.
+- `orchestra-user set -data DIR -username NAME` reads and confirms a password
+  from the terminal, creates the first operator, and resets an existing one.
+  The Docker API image includes this helper. The authenticated Settings screen
+  changes the current username/password and revokes every session for that
+  identity.
+- An existing `ORCHESTRA_WEB_USERNAME`/`ORCHESTRA_WEB_PASSWORD_HASH` pair is
+  imported once if and only if the database has no users. Once a user exists,
+  those variables are ignored with an explicit startup log, so an old `.env`
+  cannot overwrite a database credential.
+- The browser now gets its actual username from `GET /v1/ui/session`, renders
+  it in the shell, and has a dedicated account page. The login view was rebuilt
+  as a responsive desktop/mobile entry experience.
+- Frontend state drift was fixed at the same time: `needs_attention` and
+  `in_review`, plus the three newer block reasons, are in the TypeScript model,
+  board lanes, status colors, diagnosis copy, and filtering. The seven-state
+  "All" board now has an explicit layout instead of falling back to one column.
+
+Verified from the working tree after rebuilding the embedded assets:
+`go build ./...`, `go vet ./...`, and `go test ./...` all pass (21 test
+packages). The frontend TypeScript build passes, all five API-client tests
+pass, and Vite's production build emits the assets embedded by
+`internal/webui`.