feat: audit log, usage tracking UI, OpenAI orchestrator compaction, onboarding + docs

Tool audit log:
- Every orchestrator tool call logged to home/{user}/tool_audit/YYYY-MM-DD.jsonl
- Files panel sidebar: audit log group (collapsed), date-linked read-only table
- Admin endpoints: /api/audit/files, /api/audit/day, /api/audit/recent, /api/audit/stats
- Engine and model name recorded per entry

OpenAI orchestrator improvements:
- Context budget enforcement: 75% of model context_k (min 16k)
- Message compaction: truncates old tool results when approaching budget
- max_rounds respected per model config (intersected with server cap)

OpenRouter onboarding (setup.html, onboarding.py, app.js, settings.html):
- Step 3 of 3: /setup/model with curated model picker
- Chat banner for users on server-default model (informational, not alarmist)
- Settings quick-link card; /setup/model works standalone for existing users

Model registry + session store:
- set_role_config / get_role_config for per-role tool lists and system_append
- session_store: session rename, session name backfill endpoint

UI updates (app.js, index.html, style.css, local_llm.html):
- Role toggle in context panel
- Off-the-record mode
- Agent notes read-only viewer
- OPERATIONS.md loaded at T2+ in context

Documentation:
- HELP.md: full tool table, per-role tool sets, Agent Notes, usage tracking
- TOOLS.md: Agent Notes section, count corrected to 44
- ARCH__SYSTEM.md, ARCH__BACKENDS.md, MASTER.md updated to match reality
- CLAUDE.md: onboarding flow, documentation philosophy sections
- README.md: stack in practice, DeepSeek TUI mention, architecture diagram updated
- TODO__Agents.md: onboarding task completed with deviation notes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

documentation/TODO__Agents.md

@@ -7,16 +7,41 @@
 
 ## 🔴 High Priority
 
+### [UX] User onboarding — guided model setup
+New users complete password + persona setup and land directly in the chat with no working
+AI model configured. This closes that gap with a guided Step 3 and a fallback for existing
+users who skipped it or were onboarded before this existed.
+
+Design spec: `documentation/ARCH__SYSTEM.md` § Onboarding Flow
+
+- [x] **Setup Step 3 page** — new `/setup/model` GET/POST in `onboarding.py` — 2026-05-06
+  - Recommends OpenRouter: "one API key, access to Claude, Gemini, and dozens of other models"
+  - API key field + curated model dropdown (claude-3-5-haiku, claude-3-7-sonnet, gemini-2.0-flash, llama-3.3-70b)
+  - On submit: `save_host()` (OpenRouter) + `save_model()` + `set_role(chat, primary, model_id)` in `model_registry.py`
+  - Skip: `POST /setup/model/skip` reads `cx_setup_persona` cookie, redirects to chat; JS fetch on skip-link click
+  - Step labels updated: setup.html "1 of 3" / "2 of 3" / "3 of 3" (was "1 of 2" / "2 of 2")
+  - Standalone: `/setup/model` works without step labels (no `cx_setup_persona` cookie → no label)
+  - Persona creation now redirects to `/setup/model` instead of directly to chat
+- [x] **Existing user banner** — displayed in chat if no role has a model assigned — 2026-05-06
+  - Checks `GET /backend` on load (uses `available_roles` — already does role-resolution)
+  - Dismissable amber callout strip above chat: "No AI model configured — Set up OpenRouter →"
+  - Dismissed via `localStorage` key `cx_no_model_banner_dismissed`; auto-removed when a model is added
+- [x] **Settings quick-link** — amber card in settings Model Registry section — 2026-05-06
+  - Checks `GET /backend` on page load; shown if `available_roles` is empty
+  - Links to `/setup/model`
+- [x] Update `cortex/static/HELP.md` — Getting Started section + model registry quick-connect note — 2026-05-06
+- [x] Update `CLAUDE.md` — documented `/setup/model` endpoint, setup flow description, docs philosophy — 2026-05-06
+
 ### [Local] Local orchestrator — reach full parity with Gemini orchestrator
 `openai_orchestrator.py` is partially built and wired into `POST /orchestrate`.
 When the `orchestrator` role resolves to a `local_openai` model it routes there
 automatically. Remaining work is quality/reliability parity, not ground-up design.
 
-- [ ] Audit tool schema conversion — Gemini `FunctionDeclaration` → OpenAI `tools` format
-      (minor field rename, already partially done)
-- [ ] Context budget enforcement per iteration (40–50k for E4B, 35–40k for 26B A4B)
-- [ ] Context compaction — trim stale tool results mid-run when approaching limit
-- [ ] Error handling parity with Gemini orchestrator (retry logic, malformed tool calls)
+- [x] Tool schema conversion — Gemini FunctionDeclaration → OpenAI tools format
+- [x] Context budget: `_context_budget()` uses `context_k * 1000 * 0.75`, min 16k — 2026-05-06
+- [x] Context compaction: `_compact_messages()` trims old tool results before each round and before the confirmation-gate call — 2026-05-06
+- [x] Error handling: malformed tool args caught + logged; tool execution errors returned as strings
+- [ ] Retry logic on transient API errors (connection timeout, 429, 503)
 - [ ] Test end-to-end with Gemma 4 E4B and 26B A4B on scott_gaming
 - [ ] Review `ARCH__FUTURE.md` agent architecture ideas before finalising design
 - Reference: `docs/OPEN_WEBUI_API.md`, `documentation/ARCH__FUTURE.md` §1
@@ -117,7 +142,7 @@ Multi-user setup with real Gemini/Claude API costs. Track per-user token consump
 so Scott can see who's spending what.
 - [x] Count input + output tokens — local backend (OpenAI `usage` field) + Gemini API (`usage_metadata`) — 2026-05-05
 - [x] Append to `home/{user}/usage.json` — daily buckets, per-model breakdown — 2026-05-05
-- [ ] Expose via `/api/usage` endpoint; add a summary row to the Settings page
+- [x] Expose via `/api/usage` + `/api/usage/summary` + `/api/usage/all` (admin); usage table in Settings — 2026-05-06
 - [ ] Optional: soft spending limit with a warning toast when exceeded
 
 ### [Security] Tool call audit log — 2026-05-05
@@ -166,15 +191,6 @@ the foundation. What remains is removing the need to toggle manually.
   - Fast/cheap queries → local E4B (25 t/s, no API cost)
 - [ ] Routing logic in `llm_client.py` or new `router.py`; expose override in UI
 
-### [Ops] Permanent fleet hosting — home server deployment
-Currently running on `scott-lt-i7-rtx` (gaming laptop). Long-term target is the
-home server for always-on reliability. `docker-compose.yml` already exists.
-- [ ] Copy project to home server
-- [ ] Configure Nginx reverse proxy (already Docker-hosted on that machine)
-- [ ] Point `cortex.dgrzone.com` → home server internal IP (pfSense alias update)
-- [ ] WireGuard required for all access — not internet-exposed
-- [ ] Update `FLEET_MANIFEST.md` to reflect new hosting location
-
 ### [Future] Cortex Mesh — multi-instance fleet coordination
 Each fleet device runs its own Cortex instance. Instances delegate tasks to each
 other based on resources and specialisation. No central coordinator required.