feat(ops): add incident controls and upgrade surface

[distributed-nerd]

Summary

• Add admin incident controls for read-only mode, agent enablement, reconciliation, audit export, vacuum, and backup.
• Add admin/version/upgrade contract surfaces and deployment manifest upgrade metadata.
• Add frontend semantic design tokens, Tailwind token mapping, and architecture/design docs.

Closes #331
Closes #328
Closes #330
Closes #428

Testing

• Not run per request.

[drips-wave]

@distributed-nerd Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@distributed-nerd is attempting to deploy a commit to the Jaja's projects Team on Vercel.

A member of the Team first needs to authorize it.