feat: orchestrator Agent mode UI + claude_allow_dir tool + fix DDG search

- Add Agent mode toggle to web UI input row — routes through POST /orchestrate
  instead of /chat; polls for result with live tool-call count in thinking bubble
- Add cortex/tools/system.py with claude_allow_dir tool; registers in tool registry
- Fix web search: duckduckgo_search renamed to ddgs, update import + requirements.txt
- Allow WebSearch and WebFetch in ~/.claude/settings.json for Claude CLI fallback
- Add claude-allow-dir script docs and security note to CLAUDE.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -40,6 +40,7 @@ Cortex_and_Inara_dev/
     tools/
       __init__.py        ← Tool registry (Gemini FunctionDeclarations + dispatcher)
       web.py             ← DuckDuckGo web_search tool
+      system.py          ← Local machine tools (claude_allow_dir)
     static/              ← Single-page web UI (index.html, style.css, app.js)
     data/sessions/       ← Persisted session JSON files
 
@@ -142,6 +143,39 @@ http://localhost:8000/docs
 3. Syntax check: `python3 -m py_compile cortex/tools/<domain>.py`
 4. Restart Cortex
 
+## Managing Claude Code Directory Permissions
+
+Claude Code prompts (or silently hangs) when it needs to read or write a directory outside
+its current working directory. The `claude-allow-dir` script patches `~/.claude/settings.json`
+to add auto-allow rules so Claude no longer blocks on those paths.
+
+### Script: `~/.local/bin/claude-allow-dir`
+
+```bash
+# Allow read + write (default)
+claude-allow-dir ~/OSIT_dev/aether_api_fastapi
+
+# Read-only
+claude-allow-dir ~/agents_sync r
+
+# Write-only
+claude-allow-dir /tmp w
+```
+
+Adds `Read(path/*)` and/or `Edit(path/*)` + `Write(path/*)` entries to the `permissions.allow`
+array in `~/.claude/settings.json`. Idempotent — safe to run twice on the same path.
+Changes take effect in the next Claude Code session (or after opening `/hooks` in the UI).
+
+### Orchestrator tool: `claude_allow_dir`
+
+Cortex exposes this as a Gemini tool (`cortex/tools/system.py`) so the orchestrator can add
+allow rules on Inara's behalf without human intervention.
+
+**Security note:** This tool modifies Claude Code's own permission settings. The Gemini
+orchestrator calling it can grant Claude access to any directory on the machine. Keep this
+in mind when evaluating orchestrator behavior — it should only be invoked when Scott has
+clearly asked for a directory to be unblocked.
+
 ## Adding a New Router
 
 1. Create `cortex/routers/<name>.py` with `router = APIRouter()`