feat: orchestrator Agent mode UI + claude_allow_dir tool + fix DDG search

- Add Agent mode toggle to web UI input row — routes through POST /orchestrate
  instead of /chat; polls for result with live tool-call count in thinking bubble
- Add cortex/tools/system.py with claude_allow_dir tool; registers in tool registry
- Fix web search: duckduckgo_search renamed to ddgs, update import + requirements.txt
- Allow WebSearch and WebFetch in ~/.claude/settings.json for Claude CLI fallback
- Add claude-allow-dir script docs and security note to CLAUDE.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/tools/web.py

@@ -35,7 +35,7 @@ async def search(query: str, max_results: int | None = None) -> str:
 
 def _sync_search(query: str, max_results: int) -> list[dict]:
     """Synchronous DuckDuckGo search — run via asyncio.to_thread."""
-    from duckduckgo_search import DDGS
+    from ddgs import DDGS
 
     kwargs = {}
     if settings.ddg_api_key: