Sync cezen-portal/ from live working copy (V1.0 GA polish + search-icon ordering fix)

Brings the ISO-packaged portal copy current with the live cezen-portal/
working directory, which had drifted across the entire V1.0 GA polish
initiative (Phases 1-10) plus this session's topnav icon-order bugfix.

- 52 existing files updated, 2 new pages added (about.html, health.html)
- cgit/cezen-portal/ is now byte-identical to cezen-portal/
- Backend files (rag_ingest.py, cezen_license.py) already in sync;
  main.py intentionally left as-is (cgit is ahead there with
  workstation-category commercial-fit logic not yet backported to the
  live working copy)

Next: rebuild the ISO (bash autoinstall/build-iso.sh) to bake this in.

cezen-portal/login.html

@@ -4,7 +4,7 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Sign In — Nexus One AI</title>
-  <link rel="stylesheet" href="style.css?v=4">
+  <link rel="stylesheet" href="style.css?v=12">
   <style>
     body {
       background:
@@ -41,7 +41,7 @@
     }
 
     .login-card {
-      background:var(--navy2);
+      background:var(--surface);
       border: 1px solid var(--border);
       border-radius: 16px;
       padding: 36px 32px;
@@ -51,12 +51,12 @@
     .login-title {
       font-size: 20px;
       font-weight: 700;
-      color: var(--ink);
+      color: var(--text-primary);
       margin-bottom: 6px;
     }
     .login-subtitle {
       font-size: 14px;
-      color: var(--lt);
+      color: var(--text-tertiary);
       margin-bottom: 28px;
     }
 
@@ -65,22 +65,22 @@
       display: block;
       font-size: 13px;
       font-weight: 600;
-      color: var(--med);
+      color: var(--text-secondary);
       margin-bottom: 6px;
     }
     .login-input {
       width: 100%;
       padding: 11px 14px;
-      border: 1.5px solid var(--bdr);
+      border: 1.5px solid var(--border);
       border-radius: 8px;
       font-size: 15px;
-      color: var(--ink);
-      background:var(--navy2);
+      color: var(--text-primary);
+      background:var(--surface);
       transition: border-color .15s, box-shadow .15s;
       outline: none;
     }
     .login-input:focus {
-      border-color: var(--teal);
+      border-color: var(--brand);
       box-shadow: var(--shadow-focus);
     }
 
@@ -99,13 +99,13 @@
     }
     .login-btn:hover   { background: var(--brand-hover); }
     .login-btn:active  { transform: scale(.98); }
-    .login-btn:disabled { background: var(--xlt); cursor: not-allowed; }
+    .login-btn:disabled { background: var(--text-disabled); cursor: not-allowed; }
 
     .login-error {
       display: none;
-      background: #FEF2F2;
-      border: 1px solid #FECACA;
-      color: #F87171;
+      background: var(--red-lt);
+      border: 1px solid var(--red-border);
+      color: var(--red);
       padding: 10px 14px;
       border-radius: 8px;
       font-size: 13px;
@@ -127,7 +127,7 @@
       justify-content: center;
       gap: 6px;
       font-size: 12px;
-      color: var(--lt);
+      color: var(--text-tertiary);
       margin-top: 20px;
     }
   </style>
@@ -137,7 +137,7 @@
 
     <div class="login-brand">
       <div class="login-brand-name">Nexus One <span>AI</span></div>
-      <div class="login-brand-sub">Management Portal · Basic Tier</div>
+      <div class="login-brand-sub">Management Portal · <span data-brand="tier">Basic Tier</span></div>
     </div>
 
     <div class="login-card">
@@ -161,7 +161,7 @@
       </form>
 
       <div class="login-secure">
-        🔒 &nbsp;Secure · on-premises · air-gapped capable
+        Secure · on-premises · air-gapped capable
       </div>
     </div>
 
@@ -219,6 +219,6 @@
     }
   });
 </script>
-<script src="branding.js"></script>
+<script src="branding.js?v=3"></script>
 </body>
 </html>