Phase 7: authored assets (diagrams, code exhibits, client wall, budget)

Phase 7 is mostly authored assets. This commit is the asset half; the
template half is a Builder child issue because this phase must not write
application code.

DoD items satisfied or advanced:

- [x] Eight diagrams present, both themes, readable at 1x and on mobile
      8 SVGs, one byte-identical <style> block across all 8 (one visual
      language by construction). Light and dark resolve from a single file
      via prefers-color-scheme, verified per file in Chrome: 8/8 return two
      distinct palettes. Geometry verified with getBBox(), not estimated:
      0 findings after fixing 74 (text overflow, partial overlap, empty
      text, out-of-viewBox). Mobile type at the 900px minimum is 14.1/12.2px.

- [x] Six code exhibits with a two-sentence rationale each
      212 verbatim lines across five eras, copied with cp/sed from the
      read-only archive. Every rationale is exactly two sentences about why
      the code is good; every exhibit also carries an honest_note, and where
      the code is not good the note says so (the 3,400-line procedural PHP
      script is presented for its operational judgement, not its structure).

- [~] Every image optimised; total page weight budgeted and recorded
      BUDGET.md records measured raw and gzip weights for all 15 served
      files: 63,802 B raw / 13,220 B gzipped. Zero rasters by design. Page
      weight of a real page is not measurable until Phase 2 templates and
      Phase 3 serving exist, and is recorded as open rather than asserted.

- [x] Archive never linked or exposed
      No mount paths or volume names under content/. Provenance recorded as
      "private archive, path withheld".

- [ ] Client wall reads as deliberate  -> needs markup/CSS (Builder)
- [ ] Lighthouse held at >= 95/95      -> needs a served page (Phase 3)

Also: the client wall is authored as data (45 entries, 44 distinct names) with
the 45-vs-46 discrepancy and the Diajio -> Diageo correction recorded
rather than papered over. No commercial marks are enabled: that is a
permission decision for Sam, so availability is recorded and permission is not
implied.

content/assets/diagrams/02-agent-architecture.svg

@@ -0,0 +1,98 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 540" width="960" height="540" role="img" aria-labelledby="ttl dsc">
+<title id="ttl">Agent architecture</title>
+<desc id="dsc">The operator reaches a fleet of agent sessions through one inbox. Paperclip is the control plane and delegates to peer projects, which answer the Hub read-only. Every model call in the estate passes through one gateway, OmniRoute.</desc>
+<style>
+    text{font-family:ui-sans-serif,-apple-system,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;fill:#1b222b;font-size:15px}
+    .hd{font-size:15px;font-weight:600}
+    .sub{font-size:13px;fill:#5b6673}
+    .cap{font-size:12px;fill:#5b6673;letter-spacing:.06em;text-transform:uppercase;font-weight:600}
+    .big{font-size:19px;font-weight:600}
+    .node{fill:#f4f6f8;stroke:#c3ccd6;stroke-width:1.4}
+    .node-a{fill:#e9f1fd;stroke:#1a6bc4;stroke-width:1.4}
+    .node-t{fill:#e6f4f2;stroke:#0f766e;stroke-width:1.4}
+    .node-w{fill:#fdf1e3;stroke:#b45309;stroke-width:1.4}
+    .zone{fill:none;stroke:#aab4c0;stroke-width:1.4;stroke-dasharray:7 6}
+    .rule{stroke:#d0d7df;stroke-width:1}
+    .ln{stroke:#6b7684;stroke-width:1.6;fill:none}
+    .ln.d{stroke-dasharray:6 5}
+    .ln.a{stroke:#1a6bc4}
+    .ln.t{stroke:#0f766e}
+    .ln.w{stroke:#b45309}
+    .mN{fill:#6b7684}
+    .mA{fill:#1a6bc4}
+    .mT{fill:#0f766e}
+    .mW{fill:#b45309}
+    .dot{fill:#6b7684}
+    .tick{stroke:#aab4c0;stroke-width:1.2}
+  @media (prefers-color-scheme: dark){
+    text{fill:#e7edf4}
+    .sub,.cap{fill:#98a4b3}
+    .node{fill:#182028;stroke:#35424f}
+    .node-a{fill:#11253d;stroke:#5aa2f0}
+    .node-t{fill:#0d2624;stroke:#38b3a6}
+    .node-w{fill:#2a1d10;stroke:#d98b3f}
+    .zone{stroke:#43525f}
+    .rule{stroke:#2c3743}
+    .ln{stroke:#8496a6}
+    .ln.a{stroke:#5aa2f0}
+    .ln.t{stroke:#38b3a6}
+    .ln.w{stroke:#d98b3f}
+    .mN{fill:#8496a6}
+    .mA{fill:#5aa2f0}
+    .mT{fill:#38b3a6}
+    .mW{fill:#d98b3f}
+    .dot{fill:#8496a6}
+    .tick{stroke:#43525f}
+  }
+</style>
+<defs>
+  <marker id="aN" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path class="mN" d="M0,0 L10,5 L0,10 z"/></marker>
+  <marker id="aA" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path class="mA" d="M0,0 L10,5 L0,10 z"/></marker>
+  <marker id="aT" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path class="mT" d="M0,0 L10,5 L0,10 z"/></marker>
+  <marker id="aW" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path class="mW" d="M0,0 L10,5 L0,10 z"/></marker>
+</defs>
+  <text x="24" y="40" class="big">Agent architecture — operator, control plane, peers, one gateway</text>
+  <rect x="360" y="62" width="240" height="56" rx="7" class="node "/>
+  <text x="480.0" y="88.0" class="hd" text-anchor="middle">Operator</text>
+  <text x="480.0" y="106.0" class="sub" text-anchor="middle">one inbox for runs and approvals</text>
+  <path d="M480,118 L480,146" class="ln " marker-end="url(#aN)"/>
+  <rect x="330" y="146" width="300" height="62" rx="7" class="node "/>
+  <text x="480.0" y="175.0" class="hd" text-anchor="middle">TUIOS fleet</text>
+  <text x="480.0" y="193.0" class="sub" text-anchor="middle">four hosts · survive disconnect</text>
+  <path d="M400,208 L300,236" class="ln " marker-end="url(#aN)"/>
+  <path d="M480,208 L480,236" class="ln " marker-end="url(#aN)"/>
+  <path d="M560,208 L680,236" class="ln " marker-end="url(#aN)"/>
+  <rect x="40" y="236" width="250" height="132" rx="7" class="node "/>
+  <text x="54" y="262" class="hd">Hub</text>
+  <text x="54" y="282" class="sub">house entry point for every project</text>
+  <path d="M40,292 L290,292" class="rule"/>
+  <text x="54" y="314" class="sub">/capabilities  ·  /ask (read-only)</text>
+  <text x="54" y="334" class="sub">/notify  ·  Apprise delivery</text>
+  <text x="54" y="356" class="sub">no write path to peers</text>
+  <rect x="355" y="236" width="250" height="132" rx="7" class="node "/>
+  <text x="369" y="262" class="hd">Paperclip</text>
+  <text x="369" y="282" class="sub">control plane · the system of record</text>
+  <path d="M355,292 L605,292" class="rule"/>
+  <text x="369" y="314" class="sub">issues · runs · approvals</text>
+  <text x="369" y="334" class="sub">agent identities · budgets</text>
+  <text x="369" y="356" class="sub">routines · blocked-by edges</text>
+  <rect x="670" y="236" width="250" height="132" rx="7" class="node "/>
+  <text x="684" y="262" class="hd">Peer data projects</text>
+  <text x="684" y="282" class="sub">own service, own port, own folder</text>
+  <path d="M670,292 L920,292" class="rule"/>
+  <text x="684" y="314" class="sub">resume  (this site)</text>
+  <text x="684" y="334" class="sub">compass_nhs  ·  email_agent</text>
+  <text x="684" y="356" class="sub">IoT estate  ·  signage</text>
+  <path d="M605,302 L670,302" class="ln " marker-end="url(#aN)"/>
+  <text x="637.5" y="295.0" class="sub" text-anchor="middle">delegates</text>
+  <path d="M290,320 L355,320" class="ln " marker-end="url(#aN)"/>
+  <rect x="200" y="404" width="560" height="76" rx="7" class="node node-t"/>
+  <text x="480" y="432" class="hd" text-anchor="middle">OmniRoute — the only model gateway</text>
+  <text x="480" y="454" class="sub" text-anchor="middle">fast · mid · escalation tier   |   token caps   |   monthly ceiling   |   trace log</text>
+  <path d="M480,368 L480,404" class="ln t" marker-end="url(#aT)"/>
+  <path d="M120,368 L260,404" class="ln t" marker-end="url(#aT)"/>
+  <path d="M795,368 L700,404" class="ln t" marker-end="url(#aT)"/>
+  <text x="480" y="502" class="sub" text-anchor="middle">OpenRouter · DeepSeek · Gemini · MiniMax · Qwen</text>
+  <text x="480" y="520" class="sub" text-anchor="middle">reachable only through the gateway</text>
+  <text x="24" y="498" class="sub">Enforced by configuration, not convention: no service holds a provider key, so none can bypass the gateway.</text>
+</svg>