feat: sync with upstream — v1.2.0, in-app updates, Projects, modules

Brings the public tree back in line with the development repo after several
weeks of drift caused by a stale publish include list.

New:
- In-app update path: GET /update/check compares the checkout against
  origin/main and POST /update/apply runs `ncp upgrade` detached (pull,
  rebuild, restart). The sidebar shows the version, checks on click, and
  offers an "update available" pill.
- Projects: a project workspace groups chats and RAG documents, with
  per-project instructions and document retrieval scoped to the active
  project. Replaces the standalone Documents page.
- modules/: auto-discovered feature plugins (mail, network) with their
  frontend counterparts and tests.
- Memory curation runs in-process (synapse/memory/curator.py) on the chat
  model when a conversation goes idle. The separate memory service on :8001
  is gone, along with the launcher lines that started it.

Also: the KDE theme, panel and Promethean terminal assets, the full test
suite, and VERSION 1.2.0.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

assets/themes/KDE/panel-layout.js

@@ -0,0 +1,63 @@
+/*
+    NexusOS Plasma panel layout — the XFCE panel, rebuilt with native widgets.
+
+    Applied through Plasma's scripting API rather than by editing
+    plasma-org.kde.plasma.desktop-appletsrc directly: the file is owned by a
+    running plasmashell, which rewrites it from memory on exit and would
+    clobber anything written underneath it. Run with:
+
+        qdbus org.kde.plasmashell /PlasmaShell evaluateScript "$(cat panel-layout.js)"
+
+    Source layout is assets/themes/restore-snapshot/xfconf-xml/xfce4-panel.xml:
+    a 36px full-width top panel, Whisker menu at the far left with the Nexus N
+    as its button, everything else pushed to the right — tray, volume,
+    bluetooth, network, battery, clock.
+
+    The XFCE panel carried no window list; Plank showed running apps. So this
+    adds no task manager either, and the dock keeps that job.
+
+    Widget mapping from the XFCE plugins:
+      whiskermenu          -> org.kde.plasma.kickoff (same N button icon)
+      separator (expand)   -> org.kde.plasma.panelspacer
+      systray + notify     -> org.kde.plasma.systemtray (notifications live in it)
+      genmon network       -> networkmanagement, inside the tray
+      genmon bluetooth     -> bluetooth, inside the tray
+      pulseaudio           -> volume, inside the tray
+      power-manager        -> battery, inside the tray
+      clock                -> org.kde.plasma.digitalclock
+      genmon nexus         -> not a panel widget; the dock keeps nexus-core
+*/
+
+var panel = panelById(panelIds[0]);
+if (!panel) {
+    panel = new Panel;
+}
+
+panel.location = "top";
+panel.height = 36;          // xfce4-panel.xml: size=36
+panel.alignment = "left";
+panel.hiding = "none";
+
+// Start from a known state so re-running is idempotent rather than additive.
+var existing = panel.widgetIds;
+for (var i = 0; i < existing.length; i++) {
+    var w = panel.widgetById(existing[i]);
+    if (w) { w.remove(); }
+}
+
+var launcher = panel.addWidget("org.kde.plasma.kickoff");
+launcher.currentConfigGroup = ["General"];
+// __NEXUS_ROOT__ is substituted by install-plasma.sh so a clone in another
+// directory, or another user, gets a working path rather than this box's.
+launcher.writeConfig("icon", "__NEXUS_ROOT__/assets/n-small.png");
+launcher.writeConfig("favoritesPortedToKAstats", true);
+
+panel.addWidget("org.kde.plasma.panelspacer");
+
+var tray = panel.addWidget("org.kde.plasma.systemtray");
+
+var clock = panel.addWidget("org.kde.plasma.digitalclock");
+clock.currentConfigGroup = ["Appearance"];
+clock.writeConfig("showDate", true);
+
+panel.reloadConfig();