feat: online verification, node removals, and knowledge browser

Adds claim-bound online evidence records and citation verification scripts,
node removal transport/adapter, retrieval benchmark and owner-review tooling,
GraphCanvas/SourceDetail knowledge browser UI, and the ingest handoff helper.
Bumps the agents/gewu pack to the online-verification branch.

web/src/shell/Admin.tsx

@@ -123,8 +123,28 @@ function Admin({ personal = false }: { personal?: boolean }) {
     setCurrentPrincipal(identity.principal_id ?? '');
     if (!personal) setProjectRecords(availableProjects as Project[]);
   }, [personal, offset]);
-  const refreshAdminData = useCallback(() => load(csrf), [load, csrf]);
-  const loadAdminPage = useCallback((page: number) => load(csrf, page), [load, csrf]);
+  const handleSessionError = useCallback((failure: unknown) => {
+    if (failure instanceof AdminRequestError && failure.status === 401) {
+      setCsrf(''); setCredentials([]); setEvents([]); setProjects([]); setIssued(null);
+      setMessage('Your session ended. Connect again to continue.');
+    }
+  }, []);
+  const refreshAdminData = useCallback(async () => {
+    try {
+      await load(csrf);
+    } catch (failure) {
+      handleSessionError(failure);
+      throw failure;
+    }
+  }, [load, csrf, handleSessionError]);
+  const loadAdminPage = useCallback(async (page: number) => {
+    try {
+      await load(csrf, page);
+    } catch (failure) {
+      handleSessionError(failure);
+      throw failure;
+    }
+  }, [load, csrf, handleSessionError]);
 
   async function connect(session: { csrf_token: string }, isPasswordAccount: boolean, restored = false) {
     setBusy(true); setError('');