Fix CI failures: remove unicode and fix lean build

- Replace all unicode (emojis, checkmarks, arrows, em-dashes) with ASCII in .claude/ docs
- Comment out OperatingSystemsList route in core.js - breaks lean builds without computers plugin
- Comment out Operating Systems tab in ModelCatalogHub
- TODO: Plugins should dynamically register their settings routes

Fixes #2 CI check failures on wj branch

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

.claude/plans/security-improvements.md

@@ -148,11 +148,11 @@ Contact: [internal security team email]
 
 ## What's Already Good:
 
-✅ Strong .gitignore (lines 64-86 cover most credential patterns)
-✅ Darkwing scanning on PRs
-✅ Air-gapped deployment (secrets never in GitHub)
-✅ ADR-016: Device tokens instead of user credentials for kiosks
-✅ Collector tokens are 64-char hashes, not readable passwords
+[X] Strong .gitignore (lines 64-86 cover most credential patterns)
+[X] Darkwing scanning on PRs
+[X] Air-gapped deployment (secrets never in GitHub)
+[X] ADR-016: Device tokens instead of user credentials for kiosks
+[X] Collector tokens are 64-char hashes, not readable passwords
 
 ---
 
@@ -190,5 +190,5 @@ gitleaks detect --verbose
 
 - GitHub Security tab: https://github.com/ge-aero/shopdb-flask/security
 - Secret scanning alerts: (once enabled)
-- Darkwing findings: Security → Code scanning
-- Dependabot alerts: Security → Dependabot
+- Darkwing findings: Security -> Code scanning
+- Dependabot alerts: Security -> Dependabot