Sync cezen-portal/ from live working copy (V1.0 GA polish + search-icon ordering fix)

Brings the ISO-packaged portal copy current with the live cezen-portal/
working directory, which had drifted across the entire V1.0 GA polish
initiative (Phases 1-10) plus this session's topnav icon-order bugfix.

- 52 existing files updated, 2 new pages added (about.html, health.html)
- cgit/cezen-portal/ is now byte-identical to cezen-portal/
- Backend files (rag_ingest.py, cezen_license.py) already in sync;
  main.py intentionally left as-is (cgit is ahead there with
  workstation-category commercial-fit logic not yet backported to the
  live working copy)

Next: rebuild the ISO (bash autoinstall/build-iso.sh) to bake this in.

cezen-portal/security.html

@@ -4,7 +4,7 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Security &amp; Privacy — Nexus One AI Portal</title>
-  <link rel="stylesheet" href="style.css?v=4">
+  <link rel="stylesheet" href="style.css?v=12">
 </head>
 <body data-role="admin">
 
@@ -49,6 +49,7 @@
         <a href="guardrails.html">Guardrails</a>
         <a href="console.html">Console</a>
         <a href="audit.html">Governance & Audit</a>
+        <a href="health.html">Health Center</a>
         <a href="feedback.html">Feedback &amp; Ratings</a>
         <a href="settings.html">Settings</a>
       </div>
@@ -71,7 +72,7 @@
       </div>
     </div>
   </nav>
-    <a href="notifications.html" style="position:relative">🔔</a>
+    <a href="notifications.html" class="nav-icon-btn" style="position:relative" aria-label="Notifications"><span class="icon-svg icon-sm" aria-hidden="true"><svg viewBox="0 0 24 24"><path d="M15 17h5l-1.4-1.4A2 2 0 0 1 18 14.2V11a6 6 0 1 0-12 0v3.2a2 2 0 0 1-.6 1.4L4 17h5"/><path d="M10 17a2 2 0 0 0 4 0"/></svg></span></a>
     <span class="badge" data-brand="tier">Basic Tier</span>
   <div id="nav-org-logo" class="nav-org-logo"></div>
 </header>
@@ -87,27 +88,27 @@
   <!-- TRUST BANNER -->
   <div class="sec-trust-bar">
     <div class="sec-trust-item">
-      <div class="sec-trust-icon">🔒</div>
+      <div class="sec-trust-icon">Lock</div>
       <div class="sec-trust-label">Air-Gapped</div>
       <div class="sec-trust-sub">Operates fully offline</div>
     </div>
     <div class="sec-trust-item">
-      <div class="sec-trust-icon">🏛️</div>
+      <div class="sec-trust-icon">On</div>
       <div class="sec-trust-label">On-Premises</div>
       <div class="sec-trust-sub">Your hardware, your network</div>
     </div>
     <div class="sec-trust-item">
-      <div class="sec-trust-icon">🚫</div>
+      <div class="sec-trust-icon">No</div>
       <div class="sec-trust-label">No Cloud</div>
       <div class="sec-trust-sub">Zero external API calls</div>
     </div>
     <div class="sec-trust-item">
-      <div class="sec-trust-icon">📁</div>
+      <div class="sec-trust-icon">Local</div>
       <div class="sec-trust-label">Local Storage</div>
       <div class="sec-trust-sub">All data stays on your server</div>
     </div>
     <div class="sec-trust-item">
-      <div class="sec-trust-icon">👤</div>
+      <div class="sec-trust-icon">User</div>
       <div class="sec-trust-label">Access Control</div>
       <div class="sec-trust-sub">User login &amp; permissions</div>
     </div>
@@ -116,7 +117,7 @@
   <!-- THE CORE ANSWER -->
   <div class="section-title">The most important question: where does my data go?</div>
   <div class="sec-answer-block">
-    <div class="sec-answer-icon">🏠</div>
+    <div class="sec-answer-icon"><span class="icon-svg icon-xl" aria-hidden="true"><svg viewBox="0 0 24 24"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><path d="M9 22V12h6v10"/></svg></span></div>
     <div class="sec-answer-text">
       <h3>Nowhere. It stays on your server.</h3>
       <p>When you type a prompt, upload a document, or ask the AI a question, that data is processed entirely by the AI model running on your own server — the same server sitting in your data centre or server room. It does not travel to OpenAI, Anthropic, Google, or any other company. It does not touch the internet. The AI model itself is stored locally and runs locally.</p>
@@ -227,8 +228,8 @@
       <thead>
         <tr>
           <th>Question</th>
-          <th class="col-cezen">✅ Nexus One AI (On-Premises)</th>
-          <th class="col-cloud">⚠️ Cloud AI (ChatGPT, Gemini, etc.)</th>
+          <th class="col-cezen">Nexus One AI (On-Premises)</th>
+          <th class="col-cloud">Cloud AI (ChatGPT, Gemini, etc.)</th>
         </tr>
       </thead>
       <tbody>
@@ -299,7 +300,7 @@
 
   <!-- CONTACT -->
   <div class="sec-contact">
-    <div class="sec-contact-icon">🛡️</div>
+    <div class="sec-contact-icon">Support</div>
     <h3>Security questions or concerns?</h3>
     <p>If your organisation's security team needs technical documentation, architecture diagrams, or a briefing on the system's security posture, contact Cezen support.</p>
     <a href="mailto:support@cezentech.com" class="btn-primary" style="display:inline-block;margin-top:16px;text-decoration:none">Contact Cezen Support</a>
@@ -308,11 +309,11 @@
 </div>
 
 <footer>
-  <p>Nexus One AI &nbsp;·&nbsp; Powered by Cezen &nbsp;·&nbsp; Basic Tier</p>
+  <p>Nexus One AI &nbsp;·&nbsp; Powered by Cezen &nbsp;·&nbsp; <span data-brand="tier">Basic Tier</span></p>
   <p>Questions? <a href="mailto:support@cezentech.com">support@cezentech.com</a> &nbsp;·&nbsp; <a href="https://cezentech.com" target="_blank">cezentech.com</a></p>
 </footer>
 
 <script src="auth.js"></script>
-<script src="branding.js"></script>
+<script src="branding.js?v=3"></script>
 </body>
 </html>