feat: audit log, usage tracking UI, OpenAI orchestrator compaction, onboarding + docs

Tool audit log:
- Every orchestrator tool call logged to home/{user}/tool_audit/YYYY-MM-DD.jsonl
- Files panel sidebar: audit log group (collapsed), date-linked read-only table
- Admin endpoints: /api/audit/files, /api/audit/day, /api/audit/recent, /api/audit/stats
- Engine and model name recorded per entry

OpenAI orchestrator improvements:
- Context budget enforcement: 75% of model context_k (min 16k)
- Message compaction: truncates old tool results when approaching budget
- max_rounds respected per model config (intersected with server cap)

OpenRouter onboarding (setup.html, onboarding.py, app.js, settings.html):
- Step 3 of 3: /setup/model with curated model picker
- Chat banner for users on server-default model (informational, not alarmist)
- Settings quick-link card; /setup/model works standalone for existing users

Model registry + session store:
- set_role_config / get_role_config for per-role tool lists and system_append
- session_store: session rename, session name backfill endpoint

UI updates (app.js, index.html, style.css, local_llm.html):
- Role toggle in context panel
- Off-the-record mode
- Agent notes read-only viewer
- OPERATIONS.md loaded at T2+ in context

Documentation:
- HELP.md: full tool table, per-role tool sets, Agent Notes, usage tracking
- TOOLS.md: Agent Notes section, count corrected to 44
- ARCH__SYSTEM.md, ARCH__BACKENDS.md, MASTER.md updated to match reality
- CLAUDE.md: onboarding flow, documentation philosophy sections
- README.md: stack in practice, DeepSeek TUI mention, architecture diagram updated
- TODO__Agents.md: onboarding task completed with deviation notes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

documentation/ARCH__BACKENDS.md

@@ -1,7 +1,7 @@
 # Architecture: LLM Backends
 
 > How Cortex selects and talks to AI models.
-> Last updated: 2026-04-27 (V2 schema)
+> Last updated: 2026-05-06
 
 ---
 
@@ -33,11 +33,11 @@ Resolution order for a role:
 
 ### Explicit Override
 
-The UI backend toggle cycles: **auto → claude → gemini → local → auto**
+The **Role** toggle in the Context & Memory panel cycles through configured role slots for the `chat` role: **Primary → Backup 1 → Backup 2 → auto**.
 
-- **auto** (default): role-based routing as above
-- **claude / gemini / local**: bypasses role routing; forces that backend type
-- The toggle will be redesigned in Phase 3 to cycle through chat role slots (Primary / Backup 1 / Backup 2)
+- Each slot shows the configured model label
+- `auto` uses the Primary without forcing a specific backend type
+- The ⚡ Tools toggle is independent — it routes to the `orchestrator` role regardless of the chat role selection
 
 **Fallback chain** (automatic, only when no explicit registry entry exists):
 ```
@@ -113,6 +113,8 @@ Managed at **Settings → Models** (`/settings/models`). Full provider UI coming
       "provider": "local",
       "host_id": "abc123",
       "context_k": 72,
+      "max_rounds": 5,
+      "tools": true,
       "tags": ["fast", "local"]
     }
   ],
@@ -125,6 +127,14 @@ Managed at **Settings → Models** (`/settings/models`). Full provider UI coming
 }
 ```
 
+### Optional model fields
+
+| Field | Type | Default | Meaning |
+|---|---|---|---|
+| `context_k` | int | 32 | Context window in thousands of tokens. Used for compaction budget (75% of window). |
+| `max_rounds` | int \| null | null | Per-model tool loop cap. `null` = use global `orchestrator_max_rounds`. Effective limit = `min(per_model, global)`. |
+| `tools` | bool | true | Whether this model supports tool calling. `false` = skip tool loop entirely; model gets a plain chat request. |
+
 ### host_type (local hosts)
 
 | `host_type` | Chat endpoint | Models endpoint | Use for |
@@ -210,13 +220,6 @@ Memory distillation uses `role="distill"`. Configure via Model Registry → Role
 
 `.env` override: `ROLE_DISTILL=claude_cli` (default).
 
----
-
-## Future: Phase 3 — Backend Toggle Redesign
-
-The `claude → gemini → local` toggle will be replaced with a slot toggle that cycles
-through the chat role's configured models (Primary → Backup 1 → Backup 2), showing
-the actual model label. See `DESIGN__Model_Registry_V2.md`.
 
 ---