docs: refresh README and add front-end derived banner - #140

Summary

README.md had drifted 23 commits behind develop. This brings it back to the
surface the code actually ships, and adds the product's own .top-nav panel as
the README banner — generated from the front-end source, not traced from a
screenshot.

Documentation corrections:

• packages/brand was missing from the repository layout; apps/api is now
  described as the HTTP seam plus MCP endpoint and personal-credential store.
• The retired four-tab console and the "Tools" section are replaced by the five
  cabinet sections that exist today (Overview, Payment services, Requests,
  Payment proof, Profile), and the /docs/mcp route is documented.
• The API table gains /v1/jobs/user-wallet/prepare,
  /v1/jobs/{jobId}/user-wallet/submit, /mcp, and the three
  /v1/profile/mcp-token routes, with a note that the transport and operator
  routes sit outside the frozen v1 contract pack.
• A new Agent access (MCP) section describes the non-custodial
  arc_payment / arc_payment_submit flow and the digest-stored personal
  bearers.
• Workspace identity is now recorded as derived from the verified Privy
  subject, and Graph evidence capture (plus the backfill for older committed
  settlements) is documented.
• A duplicated sentence fragment in Project status is repaired, and the status
  table gains user-wallet payments and the MCP endpoint.

The banner is generated by scripts/render-nav-panel.mjs, which reads the
palette from packages/brand/src/tokens.css, the mark geometry from
packages/brand/src/CommitRing.tsx, and the nav labels from
apps/web/src/App.tsx, then writes one SVG per theme. GitHub strips CSS from
Markdown, so the README selects between them with a <picture> element.
tokens.css remains the only source of a brand colour — no hex is retyped.

Scope and acceptance criteria

• The change is limited to the stated milestone or issue.
• Acceptance criteria are listed and satisfied.
• No unrelated cleanup is included.

Acceptance criteria:

• README reflects the routes, workspace sections, API surface, repository
  layout, and delivery status present on develop today.
• The banner is derived from front-end source; no colour, mark geometry, or nav
  label is retyped by hand.
• markdownlint, prettier --check, eslint, and tsc -b stay green.
• No behaviour, contract, or configuration change.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.
• Any non-applicable invariant is explained below.

Invariant notes:

Documentation and one build-time renderer only. No runtime code, contract,
migration, or configuration is touched, so the isolation, authorization, and
cap invariants are unchanged by construction. The README's new wording reports
the isolation behaviour already implemented on develop; it does not introduce
or relax it.

Validation

Commands and results:

node scripts/render-nav-panel.mjs: PASS (wrote docs/assets/nav-panel-{light,dark}.svg)
npx markdownlint-cli2@0.18.1 README.md: PASS (0 errors)
pnpm format:check: PASS (all matched files use Prettier code style)
pnpm lint: PASS
pnpm typecheck: PASS

pnpm test and pnpm test:browser were not re-run: the change touches no
source consumed by either suite.

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 65200cc2dfcf22912e532a157232e439d623044f

• Candidate tree SHA: n/a

• Candidate commit SHA (if already committed but unpushed): n/a

• Reviewer tool: not run

• Reviewer model: not run

• Verdict: not run

• Findings or residual risks: the user explicitly waived Gate A for this
  documentation-only change and asked for a draft PR.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: this PR

• Remote head commit SHA: 09250e4

• Remote head tree SHA: n/a

• Reviewer tool: not run

• Reviewer model: not run

• Verdict: not run

• Findings or residual risks: the user explicitly waived Gate B.

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: no independent review evidence backs this tree. The banner
  SVGs are static build output; if a brand token, the mark, or a nav label
  changes, scripts/render-nav-panel.mjs must be re-run or the README will
  drift from the UI again. Pill widths in the SVG come from per-family advance
  estimates, since Rubik cannot be measured without a font engine.
• Rollback or recovery plan: revert the single commit; nothing else depends on
  it and no runtime behaviour changes.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

Draft: opened at the user's request with Gate A and Gate B waived. It stays
in draft until a human decides whether to run the gates or merge on the local
checks alone.