homepage: amber CRT theme, VT323, current-fleet docs + API access guide

- style.css: green phosphor -> amber CRT-AMBIOS palette; docs styles for
  screenshots, code blocks, key warning (full + bare mode)
- index/admin/docs: VT323 from the Google Fonts CDN
- docs.html: rewrite #chat/#models for the live fleet (flash-server v2,
  radiance native FP8, Qwen3.5-9B Q6_K); new #api-access with OpenWebUI
  key walkthrough + Opencode and Pi configs; three OpenWebUI screenshots
- services.json: AI card details match the current fleet
- deploy-remote.sh: ship shared/homepage/img/ to /srv/homepage/
- docs: Homepage.md theme wave + OpenWebUI.md picker access-control law

serverAppConfigs-docs/Dankclaw/OpenWebUI.md

@@ -46,6 +46,17 @@ The `model` table carries exactly one decoration row, `frank-secondary`
 (context length 200,704 = the per-slot window; description: Qwen3.5-9B
 Q6_K + BF16 vision mmproj).
 
+A third gate sits *after* the table, and it is the one that bites family
+accounts (2026-10-07): a model row is only visible to a non-admin user when
+its **access permission** grants them. A seeded row defaults to admin-only,
+so the picker renders "No results found" for every regular user even though
+the connection is enabled, `model_ids` is correct, and the endpoint answers
+`/v1/models` — and `GET /api/v1/models` returns `[]` for that user while an
+admin token returns the model. Fix: set the row's `access_control` to public
+(the `access` column on the `model` row) via the admin UI (Admin Panel →
+Models → visibility) or the DB. The verification battery below must therefore
+run **as a non-admin user**, not only as an admin.
+
 Two gotchas make the wiring non-obvious:
 
 - **llama.cpp `/v1/models` is Ollama-shaped.** llama.cpp returns
@@ -113,8 +124,9 @@ The Ollama connection is disabled (`ollama.enable=false`).
    `host.containers.internal`), not a model problem.
 
 **Durability:** the model table + connections are DB-only (not git-managed);
-a fresh data volume loses them. For reproducibility, add an idempotent
-first-start seed script or document the setup in the service doc.
+a fresh data volume loses them — including the public access grant above.
+For reproducibility, add an idempotent first-start seed script or document
+the setup in the service doc.
 
 ## API access (auth-gated)