Sync cezen-portal/ from live working copy (V1.0 GA polish + search-icon ordering fix)

Brings the ISO-packaged portal copy current with the live cezen-portal/
working directory, which had drifted across the entire V1.0 GA polish
initiative (Phases 1-10) plus this session's topnav icon-order bugfix.

- 52 existing files updated, 2 new pages added (about.html, health.html)
- cgit/cezen-portal/ is now byte-identical to cezen-portal/
- Backend files (rag_ingest.py, cezen_license.py) already in sync;
  main.py intentionally left as-is (cgit is ahead there with
  workstation-category commercial-fit logic not yet backported to the
  live working copy)

Next: rebuild the ISO (bash autoinstall/build-iso.sh) to bake this in.

cezen-portal/glossary.html

@@ -4,7 +4,7 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Glossary — Nexus One AI Portal</title>
-  <link rel="stylesheet" href="style.css?v=4">
+  <link rel="stylesheet" href="style.css?v=12">
 </head>
 <body>
 
@@ -39,6 +39,7 @@
         <a href="dashboard.html">Dashboard</a>
         <a href="analytics.html">Usage Analytics</a>
         <a href="audit.html">Governance & Audit</a>
+        <a href="health.html">Health Center</a>
         <a href="feedback.html">Feedback &amp; Ratings</a>
         <span class="nav-drop-cat">MANAGE /</span>
         <a href="users.html">Users</a>
@@ -78,7 +79,7 @@
       </div>
     </div>
   </nav>
-    <a href="notifications.html" style="position:relative">🔔</a>
+    <a href="notifications.html" class="nav-icon-btn" style="position:relative" aria-label="Notifications"><span class="icon-svg icon-sm" aria-hidden="true"><svg viewBox="0 0 24 24"><path d="M15 17h5l-1.4-1.4A2 2 0 0 1 18 14.2V11a6 6 0 1 0-12 0v3.2a2 2 0 0 1-.6 1.4L4 17h5"/><path d="M10 17a2 2 0 0 0 4 0"/></svg></span></a>
     <span class="badge" data-brand="tier">Basic Tier</span>
   <div id="nav-org-logo" class="nav-org-logo"></div>
 </header>
@@ -165,7 +166,7 @@
 
     <div class="gloss-item" data-term="system prompt instructions role persona assistant">
       <div class="gloss-term">System Prompt</div>
-      <div class="gloss-def">A hidden set of instructions given to the AI before any conversation starts. It defines the AI's role, behaviour, and constraints. For example: "You are a procurement assistant for [Organisation]. Only answer questions related to procurement policy. Always cite the specific policy section your answer comes from." In Open WebUI, you set system prompts when creating custom models in Workspace → Models.</div>
+      <div class="gloss-def">A hidden set of instructions given to the AI before any conversation starts. It defines the AI's role, behaviour, and constraints. For example: "You are a procurement assistant for [Organisation]. Only answer questions related to procurement policy. Always cite the specific policy section your answer comes from." In Open WebUI, you set system prompts when creating custom models in Workspace > Models.</div>
     </div>
 
     <div class="gloss-item" data-term="quantisation quant 4bit 8bit compressed size smaller">
@@ -200,12 +201,12 @@
 
     <div class="gloss-item" data-term="guardrails content filter safety block redact pii">
       <div class="gloss-term">Guardrails</div>
-      <div class="gloss-def">Rules and filters that intercept AI queries and responses to enforce organisational policies. On Cezen, guardrails can block queries containing sensitive keywords, redact PII from responses, detect prompt injection attempts, and log policy violations. Guardrails sit between the user and the model — the user never sees that a guardrail intervened. Managed by admins at <a href="guardrails.html">Admin → Guardrails</a>.</div>
+      <div class="gloss-def">Rules and filters that intercept AI queries and responses to enforce organisational policies. On Cezen, guardrails can block queries containing sensitive keywords, redact PII from responses, detect prompt injection attempts, and log policy violations. Guardrails sit between the user and the model - the user never sees that a guardrail intervened. Managed by admins at <a href="guardrails.html">Admin > Guardrails</a>.</div>
     </div>
 
     <div class="gloss-item" data-term="connector integration database api sharepoint file">
       <div class="gloss-term">Connector</div>
-      <div class="gloss-def">A configured bridge between Nexus One AI and an external system — a database, file share, REST API, email server, or enterprise tool. Connectors allow agents and workflows to read live data from and write results to your existing systems, without you manually extracting or copying data. Credentials are stored encrypted and never exposed to the AI model directly. Managed at <a href="connectors.html">Admin → Connectors</a>.</div>
+      <div class="gloss-def">A configured bridge between Nexus One AI and an external system - a database, file share, REST API, email server, or enterprise tool. Connectors allow agents and workflows to read live data from and write results to your existing systems, without you manually extracting or copying data. Credentials are stored encrypted and never exposed to the AI model directly. Managed at <a href="connectors.html">Admin > Connectors</a>.</div>
     </div>
 
     <div class="gloss-item" data-term="model router routing rules task classification">
@@ -256,7 +257,7 @@
 
     <div class="gloss-item" data-term="api key authentication access token programmatic integration">
       <div class="gloss-term">API Key</div>
-      <div class="gloss-def">A secret token that authenticates a program (not a human) to Nexus One AI. Instead of logging in with a username and password, an application includes an API key in each request to prove it's authorised. API keys on Cezen can have per-key limits: which models they can access, how many requests per minute, and an expiry date. Managed at <a href="apikeys.html">Admin → API Keys</a>. Never share an API key publicly — treat it like a password.</div>
+      <div class="gloss-def">A secret token that authenticates a program (not a human) to Nexus One AI. Instead of logging in with a username and password, an application includes an API key in each request to prove it's authorised. API keys on Cezen can have per-key limits: which models they can access, how many requests per minute, and an expiry date. Managed at <a href="apikeys.html">Admin > API Keys</a>. Never share an API key publicly - treat it like a password.</div>
     </div>
 
     <div class="gloss-item" data-term="document intelligence extraction table parsing batch">
@@ -269,7 +270,7 @@
 </div>
 
 <footer>
-  <p>Nexus One AI &nbsp;·&nbsp; Powered by Cezen &nbsp;·&nbsp; Basic Tier</p>
+  <p>Nexus One AI &nbsp;·&nbsp; Powered by Cezen &nbsp;·&nbsp; <span data-brand="tier">Basic Tier</span></p>
   <p>Questions? <a href="mailto:support@cezentech.com">support@cezentech.com</a> &nbsp;·&nbsp; <a href="https://cezentech.com" target="_blank">cezentech.com</a></p>
 </footer>
 
@@ -285,6 +286,6 @@ function filterGlossary(query) {
 </script>
 
 <script src="auth.js"></script>
-<script src="branding.js"></script>
+<script src="branding.js?v=3"></script>
 </body>
 </html>