fix(web): categorize docs nav and stop calling sessions isolated

[yashranaway]

Summary

Implements #159.

• Docs sidebar uses explicit `documentation` / `trust` categories. No more `slice(0, 3)`.
• Overview no longer says sessions stay isolated. It renders the COMMANDS.md shared-profile contract.
• Command reference has a labeled search filter over the generated groups.
• Overview and commands pages get an on-this-page list. Skip-to-content is in the shell.
• Provenance lint fails if the isolation claim or positional slicing comes back.

Did not add Settings, Credentials, or SDK pages. Those wait on their contracts.

Closes #159

[SarthakWade]

This should not merge yet because the Web app does not build and the new command directory has correctness and accessibility gaps.

The exact PR head fails provenance lint and next build because the new shared-session extraction still looks for obsolete wording. After that is corrected, the directory still omits the shipped Credential vault section, leaves table-of-contents links pointing at sections removed by filtering, and does not announce positive result-count changes to assistive technology. Please add focused search, keyboard, responsive, and accessibility coverage as required by issue #159.

GitHub currently reports the PR as mergeable with no conflicts. The Web app required check is failing; the other required checks passed. ESLint, TypeScript, and the dependency audit passed, and I found no dependency vulnerability or secret exposure in this change.

[yashranaway]

Addressed the review: session extraction matches the current COMMANDS.md shared-profile bullet, the directory now includes Credential vault, the filter owns the TOC, and the count is a polite live region with a dedicated lint check.

[SarthakWade]

Re-reviewed the final branch after integration with current main. The directory now renders all shipped command groups, includes Credential vault, keeps filtered navigation consistent, announces result changes accessibly, and is covered by real JSDOM behavior tests plus a 375px Chromium test. Local lint, production build, browser test, protocol/security, and runtime suites pass; the required CI matrix is green.