Sync cezen-portal/ from live working copy (V1.0 GA polish + search-icon ordering fix)

Brings the ISO-packaged portal copy current with the live cezen-portal/
working directory, which had drifted across the entire V1.0 GA polish
initiative (Phases 1-10) plus this session's topnav icon-order bugfix.

- 52 existing files updated, 2 new pages added (about.html, health.html)
- cgit/cezen-portal/ is now byte-identical to cezen-portal/
- Backend files (rag_ingest.py, cezen_license.py) already in sync;
  main.py intentionally left as-is (cgit is ahead there with
  workstation-category commercial-fit logic not yet backported to the
  live working copy)

Next: rebuild the ISO (bash autoinstall/build-iso.sh) to bake this in.

cezen-portal/console.html

@@ -4,7 +4,7 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Web Console — Nexus One AI</title>
-  <link rel="stylesheet" href="style.css?v=4">
+  <link rel="stylesheet" href="style.css?v=12">
   <style>
     .console-wrap { background:#0D1117; border-radius:14px; overflow:hidden; border:1px solid #30363D; margin-bottom:24px; }
     .console-bar  { background:#161B22; padding:10px 16px; display:flex; align-items:center; gap:10px; border-bottom:1px solid #30363D; }
@@ -68,6 +68,7 @@
         <a href="dashboard.html">Dashboard</a>
         <a href="analytics.html">Usage Analytics</a>
         <a href="audit.html">Governance & Audit</a>
+        <a href="health.html">Health Center</a>
         <a href="feedback.html">Feedback &amp; Ratings</a>
         <span class="nav-drop-cat">MANAGE /</span>
         <a href="users.html">Users</a>
@@ -107,7 +108,7 @@
       </div>
     </div>
   </nav>
-    <a href="notifications.html" style="position:relative">🔔</a>
+    <a href="notifications.html" class="nav-icon-btn" style="position:relative" aria-label="Notifications"><span class="icon-svg icon-sm" aria-hidden="true"><svg viewBox="0 0 24 24"><path d="M15 17h5l-1.4-1.4A2 2 0 0 1 18 14.2V11a6 6 0 1 0-12 0v3.2a2 2 0 0 1-.6 1.4L4 17h5"/><path d="M10 17a2 2 0 0 0 4 0"/></svg></span></a>
     <span class="badge" data-brand="tier">Basic Tier</span>
   <div id="nav-org-logo" class="nav-org-logo"></div>
 </header>
@@ -173,7 +174,7 @@ sudo systemctl enable --now cezen-ttyd
 # Verify
 sudo systemctl status cezen-ttyd</pre>
 
-      <p style="margin-top:16px;font-size:12px;color:var(--lt)">⚠️ ttyd is bound to 127.0.0.1 only. Nginx proxies <code>/console/</code> to <code>localhost:7681</code> so it is accessible through this portal without exposing the port directly.</p>
+      <p style="margin-top:16px;font-size:12px;color:var(--lt)">ttyd is bound to 127.0.0.1 only. Nginx proxies <code>/console/</code> to <code>localhost:7681</code> so it is accessible through this portal without exposing the port directly.</p>
     </div>
 
     <div class="setup-card">
@@ -202,7 +203,7 @@ location /api/ {
 </div>
 
 <footer>
-  <p>Nexus One AI &nbsp;·&nbsp; Powered by Cezen &nbsp;·&nbsp; Basic Tier</p>
+  <p>Nexus One AI &nbsp;·&nbsp; Powered by Cezen &nbsp;·&nbsp; <span data-brand="tier">Basic Tier</span></p>
 </footer>
 
 <script>
@@ -261,6 +262,6 @@ function copyCmd(id) {
 checkTtyd();
 </script>
 <script src="auth.js"></script>
-<script src="branding.js"></script>
+<script src="branding.js?v=3"></script>
 </body>
 </html>