September campaign: Slack removal and review remediation

[Calmingstorm]

Scope

• Remove Slack integration while retaining legacy configuration loading and generic secret redaction; remove the unused standalone plan runner with an upgrade note.
• Persist only the requested webhook create, update or delete, preserving unrelated YAML rows, comments and placeholders; return 409 on stale edits. Mask Basic-auth passwords in webhook responses and reject webhook target writes through generic config updates. Private LAN targets remain permitted; metadata targets stay blocked.
• Keep malformed permission/token entries operator-visible without changing existing users' access. Record token repair/removal audit events without counting them as tool runs.
• Keep first MCP response on every transport and warn for duplicates. Correct knowledge ingestion, Usage reconciliation and bounded tail reading, trusted-proxy forwarding, and compatible/Ollama judge timeout without changing native Codex requests.
• Carry specific computer-use refusal and input-outcome audit metadata through post-action images, including target_changed_observe_again; add source-backed drift coverage. Future lane, not included: Hyprland discovery outcome handling and successful computer-call audit classification.
• Show Codex quota windows and remaining bars per account, probe idle accounts periodically via the live serving pool, and make failover reset-aware. If all accounts appear limited, try the earliest-reset account instead of refusing locally. Confirmed /stop leaves only Odin's public result, with a visible fallback if that post fails.
• Update route parity, API reference, WebUI checks/assets, and operator changelog.

Verification

Focused suites, WebUI npm run check and build, Ruff, config-apply and generated API-reference gates passed locally. CI on the final push is authoritative. Configured MCP and live judge checks still await an authorized branch deployment.

Boundaries

No deployment, master merge, release, or live configuration change.