Task: Add the ores.web service to the services subsystem

compass services start launches the ores.web web interface on a port inside the environment range, and compass services status reports it.

• compass services start installs and starts the ores.web unit.
• The service port sits inside the environment port range.
• The unit reads its configuration through the environment mapper.
• compass services status lists ores.web.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

Wired. ORES_WEB_PORT is offset 2 of the environment block — the slot the retired Wt client held — and compass env configure emits it together with ORES_WEB_BFF_HOST, the interface the BFF binds.

ores.web.service is in projects/modeling/service_registry.org with two new properties, :runtime: node and :entry_point:, which the org loader carries and systemd_generate renders as a Type=simple unit. The unit runs the built BFF from the component directory, appends its output to the log file compass services start polls for readiness, exports the service's own NATS certificate over the shared identity in .env, and joins ores-<env>.target. nats_certs generates its certificate, and projects/ores.web/CMakeLists.txt builds the component so the unit finds a built BFF.

Verified end to end in the sandbox once ~/.config/systemd/user became writable: the units deploy, and compass services status --use-busctl reports all 24 units running, including ores.web.service-eager_maxwell, which serves the bundle and the API on 21402 and answers a bad credential with 401 against IAM over mTLS.

The sandbox's user namespace makes the manager refuse systemctl, so compass grew --use-busctl, which reaches the same manager over the session bus. That transport is covered by tests/test_systemctl_bus.py, and the unit rendering by tests/test_systemd_generate.py.

compass services gained an optional per-service selector on start, stop, restart and status while this was verified, so the interface can be cycled on its own without bouncing the other 23 units.