feat: orchestrator Agent mode UI + claude_allow_dir tool + fix DDG search

- Add Agent mode toggle to web UI input row — routes through POST /orchestrate
  instead of /chat; polls for result with live tool-call count in thinking bubble
- Add cortex/tools/system.py with claude_allow_dir tool; registers in tool registry
- Fix web search: duckduckgo_search renamed to ddgs, update import + requirements.txt
- Allow WebSearch and WebFetch in ~/.claude/settings.json for Claude CLI fallback
- Add claude-allow-dir script docs and security note to CLAUDE.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/tools/system.py

@@ -0,0 +1,44 @@
+"""
+System tools — local machine operations.
+
+These tools affect the host system directly. Use with care.
+"""
+
+import asyncio
+import logging
+
+logger = logging.getLogger(__name__)
+
+ALLOW_SCRIPT = "/home/scott/.local/bin/claude-allow-dir"
+
+
+async def claude_allow_dir(path: str, mode: str = "rw") -> str:
+    """Add Read/Edit allow rules to ~/.claude/settings.json for a directory.
+
+    Calls the claude-allow-dir script, which edits settings.json directly.
+    Changes take effect in the next Claude Code session (or after /hooks reload).
+    """
+    if mode not in ("r", "w", "rw"):
+        return f"Error: mode must be r, w, or rw (got '{mode}')"
+
+    try:
+        proc = await asyncio.create_subprocess_exec(
+            "python3", ALLOW_SCRIPT, path, mode,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+        stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=10)
+        output = stdout.decode().strip()
+        err = stderr.decode().strip()
+
+        if proc.returncode != 0:
+            logger.warning("claude-allow-dir failed (rc=%d): %s", proc.returncode, err)
+            return f"Failed (exit {proc.returncode}): {err or output}"
+
+        return output or "Done."
+
+    except asyncio.TimeoutError:
+        return "Error: script timed out"
+    except Exception as e:
+        logger.error("claude_allow_dir error: %s", e)
+        return f"Error: {e}"