admin: completeness + UI consistency pass

Arcadia wiring:
- home: real Overview dashboard (tenants/users/audit/health probe) replacing the inherited Vibespace welcome tiles; skeleton loaders, refresh button, registers admin context
- profile: split into Account (synced via getUser/updateUser of session user) and local Preferences; updateSessionUser keeps the appbar in sync after edits
- session: drop unused signIn mock, add updateSessionUser, refresh tests
- profile schema: drop redundant Profile.name/email (session is the source of truth)
- routes: delete orphaned resources route + lib

Auth flows that previously 404'd:
- /signup, /login/forgot, /login/reset, /login/2fa wired via @crema/arcadia-auth-ui
- shared AuthShell + AuthBrand wrapper

Assistant tools (admin-tools.ts):
- +10 tools: deactivate_tenant, set_user_status, delete_user, list_memberships, list_roles, revoke_api_key, create_user, update_user, assign_role, remove_role
- list_memberships gains user_id filter for "tenants this user belongs to" queries
- search_kb / read_chunk: new token resolution (window override → VITE_ARCADIA_SEARCH_TOKEN service token → operator session JWT → "dev"); on 401/403 emit a tailored hint based on which token was used

UI consistency:
- new PageHeader component
- AppShell.title was unrendered — dropped; first-child padding on #main-content keeps the floating actions pill from colliding with header content
- removed dead "Sign in required" fallback cards from 14 routes (AppShell already redirects)
- stripped p-6 from outer wrappers across 14 routes (was double-padding under AppShell's own p-6)
- migrated home + tenants to PageHeader

arcadia-search ergonomics:
- scripts/mint-search-token.mjs + `npm run mint:search-token` mints HS512 JWT with required tenant_id claim, upserts VITE_ARCADIA_SEARCH_TOKEN into .env.local
- README/.env document the new VITE_ARCADIA_SEARCH_URL / VITE_ARCADIA_SEARCH_TOKEN knobs
- .env.local now gitignored

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/build-docs-index.mjs

@@ -22,6 +22,7 @@ const ARCADIA = resolve(ROOT, "../reference/arcadia-app")
 const OUT = resolve(ROOT, "public/docs-index.json")
 
 const SOURCES = [
+  // Arcadia platform docs (resolved against ARCADIA = ../reference/arcadia-app).
   { path: "README.md", tags: ["core"] },
   { path: "docs/ARCADIA.md", tags: ["core"] },
   { path: "docs/MODULAR_MONOLITH.md", tags: ["core"] },
@@ -29,6 +30,16 @@ const SOURCES = [
   { path: "DEPLOY.md", tags: ["ops"] },
   { path: "DEV_DEPLOY.md", tags: ["ops"] },
   { path: "DEV_SETUP.md", tags: ["ops"] },
+
+  // RAG ecosystem docs — pulled from sibling repos via per-source
+  // rootDir override. Lets the assistant answer "how do I add a
+  // tenant to arcadia-search" or "what does the browser RAG do"
+  // without leaving the chat.
+  { rootDir: "../../arcadia-search", path: "README.md", tags: ["rag", "search-service"] },
+  { rootDir: "../../arcadia-search", path: "MULTI_TENANT.md", tags: ["rag", "search-service"] },
+  { rootDir: "../../arcadia-search", path: "ARCADIA_INTEGRATION.md", tags: ["rag", "integration"] },
+  { rootDir: "../../lib-lexical-rag-ui", path: "README.md", tags: ["rag", "browser"] },
+  { rootDir: "../../arcadia-admin", path: "docs/RAG.md", tags: ["rag", "overview"] },
 ]
 
 buildIndex({