Sync cezen-portal/ from live working copy (V1.0 GA polish + search-icon ordering fix)

Brings the ISO-packaged portal copy current with the live cezen-portal/
working directory, which had drifted across the entire V1.0 GA polish
initiative (Phases 1-10) plus this session's topnav icon-order bugfix.

- 52 existing files updated, 2 new pages added (about.html, health.html)
- cgit/cezen-portal/ is now byte-identical to cezen-portal/
- Backend files (rag_ingest.py, cezen_license.py) already in sync;
  main.py intentionally left as-is (cgit is ahead there with
  workstation-category commercial-fit logic not yet backported to the
  live working copy)

Next: rebuild the ISO (bash autoinstall/build-iso.sh) to bake this in.

cezen-portal/change-password.html

@@ -4,7 +4,7 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Change Password — Nexus One AI</title>
-  <link rel="stylesheet" href="style.css?v=4">
+  <link rel="stylesheet" href="style.css?v=12">
   <style>
     body { background:var(--navy); min-height:100vh; display:flex; align-items:center; justify-content:center; padding:24px; }
     .cp-card { background:var(--navy2); border-radius:20px; padding:40px 44px; width:100%; max-width:420px; box-shadow:0 24px 64px rgba(0,0,0,.35); }
@@ -33,7 +33,7 @@
     <div class="cp-sub">Your password needs to be changed before you can continue. Choose a strong password you haven't used before.</div>
 
     <div class="cp-err" id="cp-err"></div>
-    <div class="cp-ok"  id="cp-ok">Password changed! Redirecting…</div>
+    <div class="cp-ok"  id="cp-ok">Password changed! Taking you to Quick Start…</div>
 
     <div class="cp-field">
       <label class="cp-label">New Password</label>
@@ -47,7 +47,7 @@
     <button class="cp-btn" id="cp-btn" onclick="doChange()">Change Password</button>
 
     <div class="cp-rules">
-      ✓ At least 8 characters &nbsp; ✓ Mix letters &amp; numbers
+      At least 8 characters &nbsp; and &nbsp; Mix letters &amp; numbers
     </div>
   </div>
 
@@ -84,7 +84,11 @@ async function doChange() {
 
     if (res.ok) {
       okEl.classList.add('show');
-      setTimeout(() => { window.location.href = '/index.html'; }, 1500);
+      // Forced password change only happens on an account's very first login
+      // (default admin, or any account an admin just created) — so this is
+      // the real "first run" moment. Send them to the guided Quick Start
+      // instead of straight to the dashboard.
+      setTimeout(() => { window.location.href = '/quickstart.html'; }, 1500);
     } else {
       const d = await res.json().catch(() => ({}));
       const msg = Array.isArray(d.detail)
@@ -108,6 +112,6 @@ fetch(`${API}/auth/me`, { credentials: 'include' }).then(r => {
   if (!r.ok) window.location.href = '/login.html';
 });
 </script>
-<script src="branding.js"></script>
+<script src="branding.js?v=3"></script>
 </body>
 </html>