fix(ui): session-aware landing header, clickable tiles, shell padding and spacing

- .container redefined on Carbon tokens (was Bootstrap's class — pages had
  no edge padding after the Bootstrap removal)
- landing tiles use cds-clickable-tile and — critically — matching closing
  tags: the fingerprint tile was parsed as NESTED inside the cropper tile
  (mismatched </cds-tile>), painting it on top and swallowing clicks
- landing header reflects the active session (user chip + Sign out instead
  of Sign in)
- vertical rhythm: larger panel padding, row gaps and section margins

tools/public/index.html

@@ -10,7 +10,7 @@
   <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><rect width='24' height='24' rx='4' fill='%230f62fe'/><path d='M12 5a6 6 0 0 0-6 6c0 2.6.8 4.1 1.5 5.2' fill='none' stroke='white' stroke-width='1.6' stroke-linecap='round'/><path d='M15.5 19a7.5 7.5 0 0 0 3-9.7A6 6 0 0 0 7.1 7.9' fill='none' stroke='white' stroke-width='1.6' stroke-linecap='round'/><path d='M9.5 18.5a5.5 5.5 0 0 1-.8-7.6 3.8 3.8 0 0 1 7.2 1.5 4.3 4.3 0 0 1-3.4 4.6' fill='none' stroke='white' stroke-width='1.6' stroke-linecap='round'/></svg>">
   <script type="module" src="https://1.www.s81c.com/common/carbon/web-components/version/v2.50.0/tile.min.js"></script>
   <style>
-    cds-tile:not(:defined) { visibility: hidden; }
+    cds-tile:not(:defined), cds-clickable-tile:not(:defined) { visibility: hidden; }
   </style>
 </head>
 <body class="app">
@@ -22,7 +22,7 @@
         </span>
         YOUreka <small>Tools</small>
       </a>
-      <div class="nav-right">
+      <div class="nav-right" id="nav-session">
         <a class="linklike" href="/auth/login">Sign in</a>
       </div>
     </div>
@@ -35,7 +35,7 @@
     </div>
 
     <div class="tool-grid">
-      <cds-tile href="/cropper">
+      <cds-clickable-tile href="/cropper">
         <div class="tool-card">
           <span class="tool-icon">
             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M6 2v14a2 2 0 0 0 2 2h14"/><path d="M18 22V8a2 2 0 0 0-2-2H2"/></svg>
@@ -46,9 +46,9 @@
             <svg viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M5 12h14"/><path d="m12 5 7 7-7 7"/></svg>
           </span>
         </div>
-      </cds-tile>
+      </cds-clickable-tile>
 
-      <cds-tile href="/fingerprint">
+      <cds-clickable-tile href="/fingerprint">
         <div class="tool-card">
           <span class="tool-icon">
             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 2a8 8 0 0 0-8 8c0 3.5 1 5.5 2 7"/><path d="M16 21a10 10 0 0 0 4-13 8 8 0 0 0-15.7-1"/><path d="M8 21a8 8 0 0 1-1-11 5 5 0 0 1 9.7 1.4A6 6 0 0 1 12 17"/><path d="M12 21a4 4 0 0 0 4-4 4 4 0 0 0-1.2-2.9"/></svg>
@@ -59,7 +59,7 @@
             <svg viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M5 12h14"/><path d="m12 5 7 7-7 7"/></svg>
           </span>
         </div>
-      </cds-tile>
+      </cds-clickable-tile>
     </div>
   </main>
 
@@ -69,5 +69,20 @@
       <span>Scan captures run locally via the fpagent agent &mdash; no scanner data leaves this machine except the enrolled artifacts you save.</span>
     </div>
   </footer>
+  <script>
+    // Reflect the current session in the header: Sign in vs user chip + Sign out.
+    fetch('/auth/session')
+      .then(function (r) { return r.ok ? r.json() : null; })
+      .then(function (session) {
+        var host = document.getElementById('nav-session');
+        if (!session) return; // keep the Sign in link
+        var first = (session.firstName || session.phone || '?').trim();
+        host.innerHTML =
+          '<span class="user-chip"><span class="avatar">' + first.slice(0, 2).toUpperCase() + '</span>' +
+          (session.firstName || session.phone) + '</span>' +
+          '<a class="linklike" href="/auth/logout">Sign out</a>';
+      })
+      .catch(function () { /* keep Sign in */ });
+  </script>
 </body>
 </html>