dashboard #486: drop manager special-case + enable M0V3 picker for multi-select (mara on #695)

Two changes from mara's review:

1. drop the manager special-case. Both M0V3 affordances now apply
   regardless of whether the manager is in the selection; backend
   topology::set_parent refuses the manager move and the failure
   surfaces in the bulk-action error roll-up. Matches the #443 ST0P
   policy of 'don't pre-gate manager actions, let the backend speak'.

2. enable the M0V3 → <pick> picker for multi-select. Was single-agent
   only in v1. Picker now omits every selected agent itself plus the
   union of every selected agent's descendants (cycle-safe across the
   whole batch); on submit POSTs once per selected agent sequentially,
   same shape as the existing bulk-button loop. Confirm message +
   error roll-up adapt to selection size.

docs/web-ui.md updated to match.

docs/web-ui.md

@@ -441,15 +441,18 @@ frosted-mauve bar slides up from the bottom of the viewport
   - `↻ R3BU1LD` — always available
   - `DESTR0Y` / `PURG3` — sub-agents only (disabled if manager selected)
   - `⇡ M0V3 → ROOT` (#486) — promote selected agents to top-level
-    (parent = null); disabled when all selected are already at root
-    or when the selection includes the manager.
-  - `⇢ M0V3 → [select]` (#486) — single-agent-only inline picker;
-    the dropdown lists every container that isn't the target itself
-    nor a descendant of it (client-side cycle prevention; the
-    backend's `topology::set_parent` re-checks). On submit POSTs to
-    `/api/topology/set-parent` (form-encoded `child=<name>&new_parent=<target>`),
-    which writes `topology.json` and re-emits a container snapshot so
-    the tree repaints without a page reload.
+    (parent = null); disabled when all selected are already at root.
+    Manager included with no special-case (matches the `ST0P` policy);
+    the backend's `topology::set_parent` refuses to move the manager
+    and the refusal surfaces in the failure roll-up.
+  - `⇢ M0V3 → [select]` (#486) — inline picker available for any
+    selection size. The dropdown lists every container that isn't IN
+    the selection itself nor a descendant of any selected agent
+    (client-side BFS cycle prevention across the whole batch; the
+    backend re-checks per-agent). On submit POSTs to
+    `/api/topology/set-parent` (form-encoded `child=<name>&new_parent=<target>`)
+    once per selected agent, which writes `topology.json` and re-emits
+    a container snapshot so the tree repaints without a page reload.
 - **`✕ clear`** button + `Esc` key clear the entire selection.
 
 Stale selections (agents destroyed while selected) are pruned on