Fix journey cluster defects + UX improvements across 7 clusters

P0 fixes (clean-start + route contracts):
- VexHub: fix migration 002 table name + add repair migration 003
- Gateway: add /console/admin and /api/v1/unknowns routes
- IDP: add platform.idp.admin scope to OAuth client + web config
- Risk: fix URL construction from authority to gateway base
- Unknowns: fix client path from /api/v1/scanner/unknowns to /api/v1/unknowns

P1 fixes (trust + shell integrity):
- Audit: fix module name normalization, add Authority audit source
- Stage: add persistence across web store, API contracts, DB migration 059
- Posture: add per-source error tracking + degradation banner

P2 fixes (adoption + workflow clarity):
- Rename Triage to Findings in navigation + breadcrumbs
- Command palette: show quick actions for plain text queries, fix scan routes
- Scan: add local-mode limitation messaging + queue hints
- Release: add post-seal promotion CTA with pre-filled release ID
- Welcome: rewrite around operator adoption model (Get Started + What Stella Replaces)

UX improvements:
- Status rail: convert to icon-only with color state + tooltips
- Event Stream Monitor: new page at /ops/operations/event-stream
- Sidebar: collapse Operations by default
- User menu: embed theme switcher (Day/Night/System), remove standalone toggle
- Settings: add Profile section with email editing + PUT /api/v1/platform/preferences/email endpoint
- Docs viewer: replace custom parser with ngx-markdown (marked) for proper table/code/blockquote rendering

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/Platform/StellaOps.Platform.WebService/Endpoints/PlatformEndpoints.cs

@@ -386,6 +386,44 @@ public static class PlatformEndpoints
             }
         }).RequireAuthorization(PlatformPolicies.PreferencesWrite);
 
+        preferences.MapGet("/email", async Task<IResult> (
+            HttpContext context,
+            PlatformRequestContextResolver resolver,
+            PlatformPreferencesService service,
+            CancellationToken cancellationToken) =>
+        {
+            if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
+            {
+                return failure!;
+            }
+
+            var email = await service.GetEmailPreferenceAsync(requestContext!, cancellationToken).ConfigureAwait(false);
+            return Results.Ok(email);
+        }).RequireAuthorization(PlatformPolicies.PreferencesRead);
+
+        preferences.MapPut("/email", async Task<IResult> (
+            HttpContext context,
+            PlatformRequestContextResolver resolver,
+            PlatformPreferencesService service,
+            PlatformEmailPreferenceRequest request,
+            CancellationToken cancellationToken) =>
+        {
+            if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
+            {
+                return failure!;
+            }
+
+            try
+            {
+                var email = await service.UpsertEmailPreferenceAsync(requestContext!, request, cancellationToken).ConfigureAwait(false);
+                return Results.Ok(email);
+            }
+            catch (InvalidOperationException ex)
+            {
+                return Results.BadRequest(new { error = ex.Message });
+            }
+        }).RequireAuthorization(PlatformPolicies.PreferencesWrite);
+
         var profiles = platform.MapGroup("/dashboard/profiles").WithTags("Platform Preferences");
 
         profiles.MapGet("/", async Task<IResult> (