docs: fix genuine passive-voice hits in docs/web-ui (small files)

agent.md, css-vars.md, design-guide.md, shape.md, terminal-rendering.md --
26 of 40 write-good.Passive hits rewritten to name the actor (hive-agent,
browsers, the harness, the client, lifecycle::{spawn,rebuild}, CSS, the
router, ...), reusing an actor already named nearby wherever one exists.
14 left alone: established config-state conditionals ("when X is
set/enabled/given/called"), negative-capability/state-descriptor idioms
("is gone", "is hidden", "is unchanged"), one false-positive
("typed slash commands" as a compound noun, not a passive action), a
backward-looking changelog fact with no actor worth naming, and two
deliberately-parallel rhetorical contrasts (sanitized vs XSS-safe;
cache-hit vs cache-miss) left symmetric on purpose.

dashboard.md (70 more hits) is the next docs/web-ui/ batch, not part of
this one -- big enough to deserve its own PR.

docs/web-ui/agent.md

@@ -21,8 +21,8 @@ output, not something a selector reaches by id).
 glass — `backdrop-filter: blur` lets scrolled terminal rows show
 through. Measures its own rendered height via `ResizeObserver`
 (`Header.tsx`) and writes it to a CSS custom property the content
-below reads for its offset — a fixed `6em` guess used to be baked into
-`agent.css`, which silently broke (content overlapping the header) the
+below reads for its offset — `agent.css` used to bake in a fixed `6em`
+guess, which silently broke (content overlapping the header) the
 moment any row of badges/pills wrapped onto an extra line at some
 viewport width; measuring instead of guessing closes that bug class
 structurally rather than for one specific trigger. Two columns:
@@ -77,8 +77,8 @@ structurally rather than for one specific trigger. Two columns:
     extras) — all as real `<a>` elements, not a `Dropdown`-style
     command list, so ctrl/middle-click and "copy link address" keep
     working. Each `AgentLink.kind` resolves differently: `container` →
-    same-origin path; `forge` → `state.forge_public_url + url`, and the
-    link is dropped entirely when that's unset (never guessed from
+    same-origin path; `forge` → `state.forge_public_url + url`, and
+    hive-agent drops the link entirely when that's unset (never guessed from
     `<host>:3000`); `external` → already absolute. Same source
     (`GET /api/state`'s `links` field) also feeds
     `DashboardState.links` for the dashboard card's icon strip —
@@ -121,7 +121,7 @@ and scrolls behind the fixed header + footer.
   shoulder-surfers or screenshots. `autocomplete="one-time-code"`
   is the semantic value for OAuth codes (per WHATWG): browsers may
   silently ignore `autocomplete="off"` on `type="password"`, but
-  `one-time-code` is honoured and suppresses the "save password
+  browsers honour `one-time-code` and suppress the "save password
   for this site?" prompt that would otherwise fire on submit.
 - Terminal-wrap: live event tail (sticky-bottom autoscroll +
   `↓ N new` pill when not at bottom). The pill is **anchored in
@@ -154,8 +154,8 @@ journald logs). Inbox flyout: unread messages addressed to this agent
 with `↳ reply ·` in amber. A `✓ mark all read` button appears in the
 flyout header when the inbox is non-empty; selecting it confirms then
 POSTs cross-origin to the core dashboard's `POST
-/api/agent/{name}/mark-all-read` — all pending messages for this agent
-are acked, the harness won't receive wake-prompts for them. A `{
+/api/agent/{name}/mark-all-read`, which acks all pending messages for
+this agent so the harness won't receive wake-prompts for them. A `{
 marked: N }` pill surfaces the count. After the drain the inbox list
 empties on reload (the filter is `acked_at IS NULL`, so drained
 messages disappear). Todos flyout ("loose-ends v2"): the harness-local
@@ -219,7 +219,7 @@ the full row taxonomy and dispatch logic):
   `compact_boundary` emit muted notes; `commands_changed` emits an
   expandable details row listing slash commands; `thinking_tokens`
   updates a single in-place `🧠` counter; `init`, `result`, and
-  `rate_limit_event` are dropped (noise / used elsewhere); other
+  `rate_limit_event` drop silently (noise / used elsewhere); other
   subtypes → muted `⚙ <subtype>` note.
 - `Note` → `· text`.
 - `TurnStart` → `◆ TURN ← <from>` with the wake-prompt body; a
@@ -259,8 +259,8 @@ Slash commands today:
   Arms a one-shot on the Bus; next turn runs without
   `--continue`, dropping the resume session entirely.
 - `/logout` — `POST /api/logout` (confirms first). Wipes OAuth
-  credential files, parks the agent in `needs_login`. Session
-  history (`~/.claude/projects/`) is preserved.
+  credential files, parks the agent in `needs_login`, and preserves
+  session history (`~/.claude/projects/`).
 
 Unknown `/foo` shows an error row instead of being silently sent.
 
@@ -314,17 +314,17 @@ shaped).
      session continuity — logout must stay narrowed to just the
      credential files.
   3. Flip `LoginState::NeedsLogin` + emit a `LiveEvent::Note`
-     describing exactly what was wiped, then emit
+     naming the files it just deleted, then emit
      `needs_login_idle`. The turn-loop's next iteration parks
      into `wait_for_login`, which snapshots the credential dir
      (now missing the wiped files) and resumes when a fresh
      credentials file appears via the dashboard's `/login/code`
      flow (the same mtime-resumption path manual re-login uses).
 
-  Always returns 200 with a body describing what happened —
-  per-file errors are folded into the response + the Note so the
+  Always returns 200 with a body describing what happened — it
+  folds per-file errors into the response + the Note so the
   operator sees them in the live panel rather than as an HTTP
-  error. Missing files (already logged out) are treated as
+  error. Missing files (already logged out) count as
   idempotent.
 - `GET /api/state` — cold-load snapshot (`StateSnapshot`) consumed by
   the frontend (`useAgentState.ts`) on page load and, on a poll, while
@@ -374,7 +374,7 @@ shaped).
   dimensions; enabled once the server advertises the
   `ExtendedDesktopSize` pseudo-encoding (`-308` rect in the header).
   Fit-mode state persists in `localStorage` (`screen-fit`); default
-  is on. Pointer coordinates are rescaled in `sendPointer` so clicks
+  is on. `sendPointer` rescales pointer coordinates so clicks
   land on the right pixel regardless of CSS scale.
 - `GET /screen/ws` — raw RFB byte relay: proxies WebSocket
   frames to the weston VNC server at `127.0.0.1:<vnc_port>`.
@@ -400,8 +400,8 @@ Bus events (new vocabulary on `/events/stream`):
 
 - `status_changed { status }` — `online` / `rate_limited` /
   `needs_login_idle` / `needs_login_in_progress`. Drives the
-  alive-badge. `rate_limited` is set when the harness detects a
-  429 response and cleared when the retry sleep expires.
+  alive-badge. The harness sets `rate_limited` when it detects a
+  429 response and clears it when the retry sleep expires.
 - `model_changed { model }` — drives the model chip.
 - `effort_changed { effort }` — drives the effort picker chip.
   Emitted from `Bus::set_effort` on `POST /api/effort`; applies on
@@ -452,7 +452,7 @@ input tokens of the most recent fresh claude session's first turn —
 a proxy for system-prompt + CLAUDE.md sprawl (a fresh session's first
 turn pays the full static prefix uncached). It's derived in `stats.rs`
 (`first_turn_ctx`: the first turn, `ORDER BY started_at LIMIT 1`, of
-the latest `sessions` row in the window) and is omitted from the JSON
+the latest `sessions` row in the window) and stays out of the JSON
 until the `sessions` / `turn_stats.session_id` capture has rows — so
 the chip stays hidden on older dbs (inert-until-capture).
 `stats.rs` opens the sqlite db read-only and degrades to an