Document the web app and Refstream alpha

[TeoSlayer]

Summary

• adds first-class, versioned /app/ and /refstream/ documentation pages
• explains machine linking, session state, browser starts, organizations, audit behavior, and personal-vault scope
• documents Refstream alpha.5 renderer ownership, tools, persistent agent handoffs, draft protection, backed files, persistence, and xterm fallback
• keeps Keycloak explicitly outside hosted production and describes it only as a future self-hosted adapter
• updates navigation, search, sitemap, README, llms.txt, SEO checks, and route tests

Martin Monperrus's already-merged #109 remains attributed to Martin in Git history. No unsubmitted work was copied or recreated.

Validation

• npm run check
• npm run build:web
• npm run test:app
• visually inspected both pages at 1440px and 390px