feat(frontend): implement PARTHA Iteration 1 design

[parthrohit22]

Summary

Implements the approved PARTHA Iteration 1 design across the existing frontend and resolves the responsive Architecture failure before the next release. The change also makes upload source state explicit, keeps the AI composer visible, clarifies real AI-provider state, and adds an engineer feedback gate for real-user testing.

Linked issue

Closes #252

Roadmap alignment

• Roadmap §23 workstream this advances: W4 — workflow integrations and outcome capture, by making the existing trusted repository-intelligence workflow usable for engineer testing.
• §28 market-fit criterion this moves toward: trusted output acceptance and repeated workflow use by real engineers.
• Accepted evidence it is real (test/usage/repo state, not intent): sealed-snapshot fixture data in authenticated browser QA; zero page/main overflow at 1224px and 320px; a non-zero Architecture graph at both sizes; a visible AI composer; 222 frontend tests; 888 backend tests verified passing.

What changed

• Frontend: applied the supplied cream/orange visual system, PARTHA brand asset, compact navigation, responsive page headers/cards/tables, and redesigned real email/password authentication.
• Architecture: fixed the 320px reflow and React Flow parent sizing, made manifest/actions wrap, and retained readable graph labels instead of shrinking dense graphs below legibility.
• Upload and AI: added real tab/tabpanel semantics, visible provider saved/not-configured state, mutually exclusive provider actions, truthful sealed-snapshot AI disclosure, and a viewport-safe question composer.
• Docs: added an Iteration 1 engineer feedback checklist and design-qa.md with desktop/mobile comparison evidence.
• Backend/infra: no runtime, parser, contract, migration, dependency, or infrastructure changes.

Acceptance criteria completed

• Implement the approved Iteration 1 visual direction across the existing frontend surfaces.
• Reuse the designer-supplied PARTHA logo and existing icon system.
• Remove page-level horizontal overflow at 1224px and 320px.
• Keep Architecture usable at 320px with a non-zero-size graph and reachable controls.
• Keep Upload source selection consistent with its visible form.
• Keep the AI Workspace composer visible and disclose actual provider/context limits.
• Show real AI provider configuration state without exposing saved keys.
• Preserve authentic snapshot-backed data and explicit not-assessed/not-computed states.
• Add current-behaviour documentation for engineer testing and feedback.

Testing performed

npm --prefix apps/frontend run test -- --run
PASS — 41 files, 222 tests

npm run lint:frontend
PASS

npm run build:frontend
PASS

cd apps/backend && PYTHONPATH= .venv/bin/python -m pytest
886 passed, 4 skipped; 2 loopback TLS tests were blocked by sandbox socket permissions

cd apps/backend && PYTHONPATH= .venv/bin/python -m pytest \
  tests/test_ai_egress_policy.py::test_real_tls_handshake_uses_original_hostname_for_sni_and_verification \
  tests/test_ai_egress_policy.py::test_real_tls_handshake_rejects_certificate_for_wrong_hostname
PASS with loopback permission — 2 passed

In-app browser QA with disposable sealed-snapshot fixtures
PASS — Dashboard, Architecture, Upload, AI Workspace, and AI Providers at 1224×768; Architecture and AI Workspace at 320×768

GitHub Actions — Prototype Browser Acceptance
PASS — 22 maintained browser journeys, including the WCAG 2.2 AA baseline

npm run test:prototype was not run locally because visual QA was performed through the selected in-app browser against the same disposable fixture seeder. The maintained GitHub Actions gate passed.

Screenshots

• Source: Figma Iteration 1
• Side-by-side comparison findings and viewport measurements: design-qa.md
• Redacted implementation screenshots are attached in the first PR comment.

Security and data considerations

• No auth, owner-scoping, encryption, egress allowlist, logging, or persistence behaviour changed.
• AI remains optional and receives only the existing sealed-snapshot structural projection; source-file contents are not sent.
• Provider keys remain password inputs and are never read back in full.
• Browser QA used disposable local fixtures. Screenshot guidance requires credentials, emails, repository secrets, and private source content to be removed.
• No migration, secret, .env, database, generated build output, or confidential file is included.

Dependencies and blocked work

None.

Scope changes or remaining work

• The Figma Google/GitHub authentication controls were not implemented because those providers do not exist in the current backend; adding them would create fake interactions.
• The existing React Router HydrateFallback development warning is unrelated and remains unchanged.
• Real-user invitations should begin after owner review and deployment to a testable environment.

Contributor checklist

• This PR targets dev
• I claimed the issue and had it assigned or acknowledged before starting substantial work
• The branch was created from an up-to-date upstream/dev
• The branch is rebased on the latest upstream/dev
• This PR addresses one clearly scoped issue
• This PR advances a §23 workstream toward a §28 market-fit criterion (Roadmap alignment filled)
• Every acceptance criterion I claim as complete is actually complete
• Relevant tests pass
• Documentation is updated for any user-visible change
• No secrets, credentials, local env files, or generated artifacts are included
• No unrelated files were changed
• Closing syntax (Closes) is used only because the issue is fully resolved
• Dependencies and follow-up work are linked

[parthrohit22]

Redacted Iteration 1 implementation evidence (desktop): Dashboard, Architecture, AI Workspace, and AI Providers. The source-to-build comparison and mobile measurements are recorded in design-qa.md.