Commit the concurrent session's pending web and docs work

Not my work. These nine files sat uncommitted in the shared checkout
while another session worked on them, and the UI redesign that follows
rewrites web/src/main.tsx and web/src/style.css. Committing first means
that work is recoverable rather than overwritten.

Contents, by inspection rather than by authorship: whitespace
normalisation and edits across main.tsx, 568 added lines of style.css,
client and client test changes, the orchestra-user line in build.sh, and
docs updates to AGENTS.md, AUDIT.md, DEPLOYMENT.md and the env example.

Committed at the operator's explicit instruction.

web/src/api/client.ts

@@ -50,10 +50,10 @@ async function upload(body: string) {
 }
 
 async function session(): Promise<Account | undefined> {
-	const response = await fetch('/v1/ui/session', { credentials: 'same-origin' })
-	if (response.status === 401) return undefined
-	if (!response.ok) throw await responseError(response)
-	return response.json() as Promise<Account>
+  const response = await fetch('/v1/ui/session', { credentials: 'same-origin' })
+  if (response.status === 401) return undefined
+  if (!response.ok) throw await responseError(response)
+  return response.json() as Promise<Account>
 }
 
 async function login(username: string, password: string) {
@@ -64,7 +64,7 @@ async function login(username: string, password: string) {
     body: JSON.stringify({ username, password }),
   })
   if (!response.ok) throw await responseError(response)
-	return response.json() as Promise<Account>
+  return response.json() as Promise<Account>
 }
 
 async function logout() {
@@ -76,15 +76,14 @@ async function logout() {
 }
 
 export const api = {
-	session,
+  session,
   login,
   logout,
-	account: () => request<Account>('/v1/ui/account'),
-	updateAccount: (body: { current_password: string; username: string; new_password?: string }) =>
-		request<Account>('/v1/ui/account', {
-			method: 'PUT',
-			body: JSON.stringify(body),
-		}),
+  updateAccount: (body: { current_password: string; username: string; new_password?: string }) =>
+    request<Account>('/v1/ui/account', {
+      method: 'PUT',
+      body: JSON.stringify(body),
+    }),
   overview: () => request<Overview>('/v1/ui/overview'),
   detail: (id: string) => request<Detail>(`/v1/ui/tasks/${id}`),
   artifact: (ref: string) => text(`/v1/ui/artifacts/${ref}`),