Sync cezen-portal/ from live working copy (V1.0 GA polish + search-icon ordering fix)

Brings the ISO-packaged portal copy current with the live cezen-portal/
working directory, which had drifted across the entire V1.0 GA polish
initiative (Phases 1-10) plus this session's topnav icon-order bugfix.

- 52 existing files updated, 2 new pages added (about.html, health.html)
- cgit/cezen-portal/ is now byte-identical to cezen-portal/
- Backend files (rag_ingest.py, cezen_license.py) already in sync;
  main.py intentionally left as-is (cgit is ahead there with
  workstation-category commercial-fit logic not yet backported to the
  live working copy)

Next: rebuild the ISO (bash autoinstall/build-iso.sh) to bake this in.

cezen-portal/faq.html

@@ -4,7 +4,7 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>FAQ — Nexus One AI Portal</title>
-  <link rel="stylesheet" href="style.css?v=4">
+  <link rel="stylesheet" href="style.css?v=12">
 </head>
 <body>
 
@@ -39,6 +39,7 @@
         <a href="dashboard.html">Dashboard</a>
         <a href="analytics.html">Usage Analytics</a>
         <a href="audit.html">Governance & Audit</a>
+        <a href="health.html">Health Center</a>
         <a href="feedback.html">Feedback &amp; Ratings</a>
         <span class="nav-drop-cat">MANAGE /</span>
         <a href="users.html">Users</a>
@@ -78,7 +79,7 @@
       </div>
     </div>
   </nav>
-    <a href="notifications.html" style="position:relative">🔔</a>
+    <a href="notifications.html" class="nav-icon-btn" style="position:relative" aria-label="Notifications"><span class="icon-svg icon-sm" aria-hidden="true"><svg viewBox="0 0 24 24"><path d="M15 17h5l-1.4-1.4A2 2 0 0 1 18 14.2V11a6 6 0 1 0-12 0v3.2a2 2 0 0 1-.6 1.4L4 17h5"/><path d="M10 17a2 2 0 0 0 4 0"/></svg></span></a>
     <span class="badge" data-brand="tier">Basic Tier</span>
   <div id="nav-org-logo" class="nav-org-logo"></div>
 </header>
@@ -185,7 +186,7 @@
         <span class="faq-arrow">›</span>
       </div>
       <div class="faq-a">
-        <p>Yes — this is called a <strong>system prompt</strong>. In Open WebUI, go to <strong>Workspace → Models</strong> and create a custom model. Give it a name (e.g. "HR Policy Assistant"), a system prompt (e.g. "You are an expert in this organisation's HR policies. Answer questions based on the uploaded HR documents. Always cite which policy section your answer is from."), and assign it a knowledge base. This custom model will then appear in the model selector for all users.</p>
+        <p>Yes - this is called a <strong>system prompt</strong>. In Open WebUI, go to <strong>Workspace > Models</strong> and create a custom model. Give it a name (e.g. "HR Policy Assistant"), a system prompt (e.g. "You are an expert in this organisation's HR policies. Answer questions based on the uploaded HR documents. Always cite which policy section your answer is from."), and assign it a knowledge base. This custom model will then appear in the model selector for all users.</p>
       </div>
     </div>
 
@@ -195,7 +196,7 @@
         <span class="faq-arrow">›</span>
       </div>
       <div class="faq-a">
-        <p>The system administrator can manage users from <strong>Admin Panel → Users</strong> in Open WebUI. You can invite users by email, create accounts manually, or enable open registration (where anyone on the network can sign up). Role levels are: <strong>Admin</strong> (full control), <strong>User</strong> (chat and upload), and <strong>Pending</strong> (signed up but waiting for admin approval). Admins can reset passwords and delete accounts from the same panel.</p>
+        <p>The system administrator can manage users from <strong>Admin Panel > Users</strong> in Open WebUI. You can invite users by email, create accounts manually, or enable open registration (where anyone on the network can sign up). Role levels are: <strong>Admin</strong> (full control), <strong>User</strong> (chat and upload), and <strong>Pending</strong> (signed up but waiting for admin approval). Admins can reset passwords and delete accounts from the same panel.</p>
       </div>
     </div>
 
@@ -239,7 +240,7 @@
         <span class="faq-arrow">›</span>
       </div>
       <div class="faq-a">
-        <p><a href="workflows.html">Workflows</a> are deterministic pipelines — you define a fixed sequence of steps (trigger → process → output) that runs the same way every time. Agents are more flexible — they plan their own steps based on the goal you give them. Use a workflow when the process is well-defined and repeatable (e.g., "every night at 11pm, summarise today's audit log and email it to the admin"). Use an agent when the task requires judgment and adaptation (e.g., "review these 50 contracts and flag any that contain unusual termination clauses"). In practice, you'll often use both — a scheduled workflow that kicks off an agent as one of its steps.</p>
+        <p><a href="workflows.html">Workflows</a> are deterministic pipelines - you define a fixed sequence of steps (trigger to process to output) that runs the same way every time. Agents are more flexible - they plan their own steps based on the goal you give them. Use a workflow when the process is well-defined and repeatable (e.g., "every night at 11pm, summarise today's audit log and email it to the admin"). Use an agent when the task requires judgment and adaptation (e.g., "review these 50 contracts and flag any that contain unusual termination clauses"). In practice, you'll often use both - a scheduled workflow that kicks off an agent as one of its steps.</p>
       </div>
     </div>
 
@@ -326,7 +327,7 @@
         <span class="faq-arrow">›</span>
       </div>
       <div class="faq-a">
-        <p>Yes. <a href="guardrails.html">Guardrails</a> sit between the user and the model and inspect every query before it reaches the AI, and every response before it's returned. You can configure: keyword blocks (queries containing specific words are blocked outright), regex rules (e.g., block any query containing a 16-digit number that looks like a card number), PII redaction (automatically strip email addresses, phone numbers, ID numbers from responses before they're shown), and prompt injection detection (catch attempts to override the system prompt). Rules can have actions: block (query is rejected), redact (sensitive data is removed), or warn (query proceeds but is flagged in the audit log). Guardrails are managed by admins at <strong>Admin → Tools → Guardrails</strong>.</p>
+        <p>Yes. <a href="guardrails.html">Guardrails</a> sit between the user and the model and inspect every query before it reaches the AI, and every response before it's returned. You can configure: keyword blocks (queries containing specific words are blocked outright), regex rules (e.g., block any query containing a 16-digit number that looks like a card number), PII redaction (automatically strip email addresses, phone numbers, ID numbers from responses before they're shown), and prompt injection detection (catch attempts to override the system prompt). Rules can have actions: block (query is rejected), redact (sensitive data is removed), or warn (query proceeds but is flagged in the audit log). Guardrails are managed by admins at <strong>Admin > Tools > Guardrails</strong>.</p>
       </div>
     </div>
 
@@ -365,7 +366,7 @@
 </div>
 
 <footer>
-  <p>Nexus One AI &nbsp;·&nbsp; Powered by Cezen &nbsp;·&nbsp; Basic Tier</p>
+  <p>Nexus One AI &nbsp;·&nbsp; Powered by Cezen &nbsp;·&nbsp; <span data-brand="tier">Basic Tier</span></p>
   <p>Questions? <a href="mailto:support@cezentech.com">support@cezentech.com</a> &nbsp;·&nbsp; <a href="https://cezentech.com" target="_blank">cezentech.com</a></p>
 </footer>
 
@@ -388,6 +389,6 @@ document.querySelector('.faq-q').click();
 </script>
 
 <script src="auth.js"></script>
-<script src="branding.js"></script>
+<script src="branding.js?v=3"></script>
 </body>
 </html>