Operator capture scaffold

The dedicated minimal capture PWA (§7.4, deploy flag app-operator) lands with its blueprint: KYC-bound sign-in, claim-reference resolution, camera-direct capture with sealed provenance — nothing else. Least privilege by rule.