phase: 25_masthead_control_placement

**Phase 25 final verification pass** (all 3 tasks were already in `complete/`, so this was the phase-level verify + docs pass)

**Verified**
- `#nav-status` first child of `.masthead-right` on all 7 signed-in templates (incl. `/certs`, `/settings`); `app.js`/`charts.js` untouched
- `#nav-status` + `.masthead-right` both `justify-content: flex-end`, `margin-inline-start` still absent, row-break (`flex-wrap` + two `flex-basis: 100%`), non-sticky bar, dropdown slide + 4 close paths, `setInterval(refreshStatus, 15000)` all intact (dash.css diff = comments + the two alignment values)
- Clock is the last control on all 7 templates; no `order:` anywhere in the bar

**Fixed (defects found in this pass)**
- `tests/test_api.py::test_every_page_links_to_both_admin_pages` — duplicated `tabs = html[...]` statement (task 03 edit artifact)
- `certs.html` / `settings.html` comments said "all **eight** signed-in pages"; the signed-in set is seven (`/login` is the eighth, anonymous, and has no links/clock)
- `AGENTS.md` — suite tally `1542 → 1543 passed`; "the three phase-20 tests" re-worded, since task 02 renamed one to `test_the_masthead_is_three_rows_right_justified_at_every_width`

**Results**
- `uv run pytest` → **1543 passed, 15 skipped**, 0 failed
- `bash .agents/validate.sh` → **exit 0**: coverage **98.94 %** (floor 94 %), `ruff` All checks passed, `pyright` 0 errors, `node --check` clean, hygiene clean
- `uv run pytest -m live --live` (`.env.dev` sourced) → **11 passed**; `./scripts/dev-server.sh status` → 9/9 sources `ok`
- Browser: `node data/logs/25-task03-verify.cjs` → **235 checks, 0 FAIL**, exit 0 (`data/logs/25-task03-verify.out`, 16 `masthead-25-*.png`)

**Completion criteria**: badges pinned+measured (green `system/disks/llm/ups` on both admin pages, 1280 px and 360 px) ✅ · both rows flush right, three rows + dropdown unchanged (pinned + measured) ✅ · clock farthest-right (pinned markup; measured right edge 1260.0 at 1280 px, ≤900 px hidden by the long-standing readout rule with source order asserted) ✅ · pytest/coverage/ruff/pyright ✅ · validate.sh ✅ · no behaviour change in completed work ✅

**Docs**: README reviewed end-to-end against the code (served-route audit vs documented routes, env table vs `config.py`, commands vs `scripts/`, public-path table, `web/` masthead bullet) — consistent, no changes needed beyond the phase's own edits. AGENTS.md — two fixes above; spot-checked every doc-named test, function, script, threshold, `install-agent.sh` sha256 (`ffbcd91f…` matches) and agent version (1.1.0).

**Deviations**: left the pre-existing `fastapi 0.153.0 → 0.159.0` advisory (validate prints it as advisory; no dependency work in scope, AGENTS rule 8 triggers on touching deps). No live-infra changes. Overview's "all eight signed-in pages" for the clock is verified against seven templates + `/login` (which has no clock, pinned).

**Next pending phase**: `.agents/phases/todo/26_ups_event_split/` (3 tasks).

README.md

@@ -751,13 +751,18 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
   that row count, so `/` and `/disks` can never describe two different fleets.
 * `web/` — five static dashboard pages (`/`, `/system`, `/disks`, `/llm`, `/ups`) plus the three
   admin pages (`/login`, `/settings`, `/certs`), one stylesheet, hand-rolled
-  SVG charts (`charts.js`), and a masthead status dot per dashboard job (`disks` has its own:
+  SVG charts (`charts.js`), and a masthead status dot per dashboard job on **every** signed-in
+  page — the two admin pages included (`disks` has its own:
   the same agent can answer the 10-second utilisation poll and have a wedged SMART pass).
-  The masthead is **three left-justified rows at every width**: the brand and the five dashboard
-  tabs, then the per-source indicators on their own row, then the clock / `⚷ Certs` / `⚙ Account`
-  / `☾ Dark` controls on a row under those (a page with no
-  indicators — `/login`, `/settings`, `/certs` — renders two, and a control is never hidden to make a
-  narrower width work). There is no control that stops the polling (phase 21): the bar used to carry
+  The masthead is **three rows at every width, the two control rows flush right**: the brand and the five dashboard
+  tabs, then the per-source indicators on their own row, then the `⚷ Certs` / `⚙ Account` /
+  `☾ Dark` / clock controls on a row under those, in that order, so the **time is the farthest-right
+  thing on the bar** (phase 25: the badges and the cluster were re-justified right, then the clock
+  moved to the end of the markup — `flex-end` makes the last child the rightmost item, and it stays
+  a markup fact rather than a CSS `order:` so the pin can read it; the clock is hidden below 900 px
+  as it has always been, being a readout and not a control). Only `/login` renders no
+  indicators, and so two rows, and a control is never hidden to make a
+  narrower width work. There is no control that stops the polling (phase 21): the bar used to carry
   a `⏸ Pause` button with a `Space` shortcut, and it left the numbers on screen looking current with
   no `stale` label on them. Both admin links are on all seven
   signed-in pages — the five dashboards plus `/settings` and `/certs`, the two they name included —