Adopt design comps: dark system, new landing/auth, dashboard shell + canvas

Re-skins the whole app to the dark design comps and wires the new surfaces to
the backend (the /api proxy + auth + schemas are unchanged).

Design system:
- globals.css: remapped @theme tokens to the comp palette (#08080a base, coral
  #ff6f61, status cyan/green/amber/purple/teal); token names preserved
- MeshMark: triangle + 3-node brand glyph; cm-flow/cm-blink/cm-halo keyframes
- marketing flipped light → dark

Backend (migration 0012):
- agents.model_binding (persisted on team deploy) + GET /api/claws/{id}/runtime-config
- routine_runs table + scheduler journaling + GET /api/routines/runs
- GET /api/claws/{id}/compartments (anatomy aggregate)
- GET /api/structure/stats (workspace counts)

Frontend:
- Landing: full dark marketing page (hero constellation, deploy ladder,
  12-topology taxonomy, recursive execution, compare/Pareto, safety, self-host)
- Auth: dark split-panel AuthShell + comp LoginForm + Clerk SignIn themed dark
- Dashboard shell: TopBar (breadcrumb + live stats + deploy + user) + StatusBar
  (runner/sandbox/doors); rail slimmed to 60px + 252px context column
- ConstellationCanvas (radial recursive) replaces the graph view in StructureCanvas;
  selecting a claw opens ComputerPanel (apps/now-running/dock); RoutinesPanel
- Claw anatomy view (/claws/[id]/anatomy) from compartments + runtime-config

Co-Authored-By: Claude Opus 4.8 <[email protected]>

crates/cm-api/src/routes/claws.rs

@@ -3,9 +3,10 @@ use axum::http::StatusCode;
 use axum::Json;
 use cm_db::repo::audit::Actor;
 use cm_domain::{AccessPolicy, Agent, AgentId, AgentStatus};
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
 
+use crate::runtime_provision::provider_alias_for;
 use crate::{ApiError, AppState, Authed};
 
 /// Loads an agent and enforces tenant isolation: agents in other workspaces
@@ -22,6 +23,104 @@ pub(crate) async fn workspace_agent(
     Ok(agent)
 }
 
+/// `GET /api/claws/{id}/runtime-config` — the claw's model + §15 sandbox facts
+/// (for the claw card / anatomy view's model badge).
+#[derive(Serialize)]
+pub struct RuntimeConfig {
+    pub model: Option<String>,
+    pub provider_alias: String,
+    pub sandbox_enabled: bool,
+    pub network_allowed: bool,
+}
+
+pub async fn runtime_config(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+    Path(id): Path<AgentId>,
+) -> Result<Json<RuntimeConfig>, ApiError> {
+    let agent = workspace_agent(&state, &user, id).await?;
+    let model = cm_db::repo::agents::model_binding(&state.pool, agent.id).await?;
+    let provider_alias = provider_alias_for(model.as_deref().unwrap_or("claude")).to_string();
+    Ok(Json(RuntimeConfig {
+        model,
+        provider_alias,
+        // Claws are provisioned tool-free in network-isolated sandboxes (§15).
+        sandbox_enabled: true,
+        network_allowed: false,
+    }))
+}
+
+/// One "anatomy" compartment of a claw (skills / personality / memory / tools /
+/// capabilities / safety), aggregated from existing data.
+#[derive(Serialize)]
+pub struct Compartment {
+    pub key: String,
+    pub label: String,
+    pub items: Vec<String>,
+    pub count: Option<i64>,
+}
+
+/// `GET /api/claws/{id}/compartments` — the claw anatomy view.
+pub async fn compartments(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+    Path(id): Path<AgentId>,
+) -> Result<Json<Vec<Compartment>>, ApiError> {
+    let agent = workspace_agent(&state, &user, id).await?;
+    let skills = cm_db::repo::skills::installed(&state.pool, agent.id).await?;
+    let personality = if agent.system_prompt.trim().is_empty() {
+        vec![]
+    } else {
+        vec![agent.system_prompt.clone()]
+    };
+    let out = vec![
+        Compartment {
+            key: "skills".into(),
+            label: "Skills".into(),
+            items: skills.iter().map(|s| s.title.clone()).collect(),
+            count: Some(skills.len() as i64),
+        },
+        Compartment {
+            key: "personality".into(),
+            label: "Personality".into(),
+            items: personality,
+            count: None,
+        },
+        Compartment {
+            key: "memory".into(),
+            label: "Memory".into(),
+            items: vec![],
+            count: None,
+        },
+        Compartment {
+            // The §15 "door": email/slack are gated MCP tools, browser gated,
+            // shell blocked (claws are tool-free in the sandbox).
+            key: "tools".into(),
+            label: "Tools · Doors".into(),
+            items: vec![
+                "Email · gated".into(),
+                "Slack · gated".into(),
+                "Browser · gated".into(),
+                "Shell · blocked".into(),
+            ],
+            count: None,
+        },
+        Compartment {
+            key: "capabilities".into(),
+            label: "Capabilities".into(),
+            items: vec!["File management".into(), "Scheduling".into()],
+            count: None,
+        },
+        Compartment {
+            key: "safety".into(),
+            label: "Safety · §15".into(),
+            items: vec!["Sandbox: isolated".into(), "Network: none".into()],
+            count: None,
+        },
+    ];
+    Ok(Json(out))
+}
+
 #[derive(Deserialize)]
 pub struct CreateClawRequest {
     name: String,