Commit the concurrent session's pending web and docs work

Not my work. These nine files sat uncommitted in the shared checkout
while another session worked on them, and the UI redesign that follows
rewrites web/src/main.tsx and web/src/style.css. Committing first means
that work is recoverable rather than overwritten.

Contents, by inspection rather than by authorship: whitespace
normalisation and edits across main.tsx, 568 added lines of style.css,
client and client test changes, the orchestra-user line in build.sh, and
docs updates to AGENTS.md, AUDIT.md, DEPLOYMENT.md and the env example.

Committed at the operator's explicit instruction.

deploy/DEPLOYMENT.md

@@ -8,17 +8,40 @@ coordinator deployment" below for the build that carries provenance. (The old
 
 ## Browser operator login
 
-The browser UI requires `ORCHESTRA_WEB_USERNAME` and
-`ORCHESTRA_WEB_PASSWORD_HASH`. Generate a bcrypt hash without putting the
-password in shell history:
+Browser operators now live in the embedded `${ORCHESTRA_DATA}/auth.db`
+database. Passwords are bcrypt-hashed inside that database; no password hash
+belongs in `.env`.
+
+For a new local data directory, create the first account while Orchestra is
+stopped. The command reads and confirms the password from the terminal:
 
 ```sh
-go run ./cmd/orchestra-password
+go run ./cmd/orchestra-user set -data ./data -username kami
 ```
 
-Set the emitted hash in the service environment along with the chosen
-username, then restart the coordinator. `ORCHESTRA_WEB_TOKEN` is not used by
-the browser UI anymore.
+For the Docker Compose deployment, the API image includes the same helper.
+Keep the API stopped while it opens the database, then use the existing data
+volume through Compose:
+
+```sh
+docker compose stop orchestra-api
+docker compose run --rm --entrypoint /app/orchestra-user \
+  orchestra-api set -data /data -username kami
+docker compose up -d orchestra-api
+```
+
+After signing in, the Settings screen can change the username or password.
+Every browser session for that account is revoked after a credential change.
+To recover a forgotten password, stop the API and run `orchestra-user set`
+again for the same username. `orchestra-user list -data /data` lists usernames
+without exposing password hashes.
+
+On the first start after upgrading, an empty auth database automatically
+imports the existing `ORCHESTRA_WEB_USERNAME` and
+`ORCHESTRA_WEB_PASSWORD_HASH` pair. Once the startup log confirms the import,
+remove both legacy values from `.env`; they are ignored whenever the database
+already contains an account. `ORCHESTRA_WEB_TOKEN` remains unused by the
+browser UI.
 
 Build a worker for staging on workpc with:
 
@@ -44,7 +67,7 @@ credential: its `build` object is the coordinator provenance. `GET
 /v1/federation/workers` shows every worker's `build`, supported projects, and
 worker-local health without SSH.
 
-Build both binaries with `deploy/build.sh`, which stamps them from one commit
+Build the coordinator and worker with `deploy/build.sh`, which stamps them from one commit
 and refuses a dirty tree. A burn-in run must never pair a new coordinator with
 an old worker, and matching revisions are how that is checked rather than
 assumed.

deploy/build.sh

@@ -1,5 +1,6 @@
 #!/bin/sh
-# Build the coordinator and the worker from one commit, with one stamp, so a
+# Build the coordinator, worker, and operator-account helper from one commit,
+# with one stamp, so a
 # burn-in run can never pair a new coordinator with an old worker. Both
 # binaries then report the same revision at /v1/admin/diagnostics and in the
 # worker's registration, which is what makes deployed identity evidence rather
@@ -23,4 +24,5 @@ flags="-s -w -X orchestra/internal/buildinfo.Revision=$rev -X orchestra/internal
 mkdir -p "$out"
 (cd "$tree" && go build -trimpath -ldflags="$flags" -o "$out/orchestra" ./cmd/orchestra)
 (cd "$tree" && go build -trimpath -ldflags="$flags" -o "$out/orchestra-worker" ./cmd/orchestra-worker)
+(cd "$tree" && go build -trimpath -ldflags="-s -w" -o "$out/orchestra-user" ./cmd/orchestra-user)
 echo "$rev"

deploy/orchestra.env.example

@@ -139,12 +139,11 @@ ORCHESTRA_CONTEXT_WINDOW=200000
 # --- Bus authorization tokens (bearer auth per surface; a surface with no
 # token set has no auth requirement — set these once you have real clients) ---
 #ORCHESTRA_TUI_TOKEN=
-# Required: the service refuses to start without both. The browser UI's
-# task, lifecycle and approval controls are session-gated; it no longer
-# accepts a shared Web bearer token. Generate the bcrypt hash with:
-#   go run ./cmd/orchestra-password
-ORCHESTRA_WEB_USERNAME=operator
-ORCHESTRA_WEB_PASSWORD_HASH=
+# Browser operators are stored in $ORCHESTRA_DATA/auth.db, not in this file.
+# With Orchestra stopped, create or reset one interactively with:
+#   orchestra-user set -data /data -username kami
+# Existing ORCHESTRA_WEB_USERNAME + ORCHESTRA_WEB_PASSWORD_HASH values are
+# imported once only when auth.db contains no users, then should be removed.
 # Set when the UI is served over plain HTTP, so the session cookie can be
 # sent without Secure. Leave unset behind TLS.
 #ORCHESTRA_UI_INSECURE_COOKIE=1