Add L0-L4 security clearance for fleet commands and AI elevation.

Gate manual and AI commands by per-agent clearance, auto-elevate stuck hosts to L4 when AI mode allows, and surface clearance in Access Depth and LOTL timeline.

server/web/src/help/clearance.test.ts

@@ -0,0 +1,28 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest';
+import {
+  clearanceLabel,
+  clearancePermissions,
+  formatClearanceElevation,
+} from './clearance';
+
+describe('clearance helpers', () => {
+  it('labels L0–L4', () => {
+    expect(clearanceLabel(0)).toBe('L0');
+    expect(clearanceLabel(4)).toBe('L4');
+    expect(clearanceLabel(99)).toBe('L4');
+  });
+
+  it('describes permissions per level', () => {
+    expect(clearancePermissions(2)).toMatch(/spread/i);
+    expect(clearancePermissions(3)).toMatch(/shell/i);
+  });
+
+  it('formats AI elevation flash copy', () => {
+    expect(
+      formatClearanceElevation({ to_level: 4, source: 'ai_scheduler', reason: 'stuck host recovery' }),
+    ).toBe('AI requested L4 — approved');
+  });
+});