feat(scanner): Complete PoE implementation with Windows compatibility fix

- Fix namespace conflicts (Subgraph → PoESubgraph)
- Add hash sanitization for Windows filesystem (colon → underscore)
- Update all test mocks to use It.IsAny<>()
- Add direct orchestrator unit tests
- All 8 PoE tests now passing (100% success rate)
- Complete SPRINT_3500_0001_0001 documentation

Fixes compilation errors and Windows filesystem compatibility issues.
Tests: 8/8 passing
Files: 8 modified, 1 new test, 1 completion report

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docs/ui/branding.md

@@ -0,0 +1,36 @@
+# Console Branding Guide
+
+> **Audience:** Console admins, UI Guild, Authority Guild.
+> **Scope:** Runtime branding of the Console UI (logo, title, and theme tokens).
+
+## 1. What can be customized
+- Header title text
+- Logo and favicon (SVG/PNG/JPG)
+- Theme tokens (light/dark/high-contrast CSS variables)
+- Welcome screen title and message (from config.json)
+
+## 2. Where branding is stored
+- Authority stores tenant branding records and serves them via `/console/branding`.
+- Updates are audited and require fresh-auth.
+
+## 3. Admin workflow
+1. Open **Console Admin -> Branding**.
+2. Upload logo and favicon (max 256KB).
+3. Adjust theme tokens using the palette editor.
+4. Preview changes (no persistence).
+5. Apply changes (requires fresh-auth).
+
+## 4. Offline workflow
+- Export branding bundle from the Admin panel.
+- Import via Authority offline bundle apply.
+- UI shows the applied branding hash for verification.
+
+## 5. Security and guardrails
+- Only whitelisted tokens are accepted.
+- No external CSS or remote font URLs are allowed.
+- Branding updates emit `authority.branding.updated` audit events.
+
+## 6. References
+- `docs/architecture/console-branding.md`
+- `docs/ui/admin.md`
+