Embed Reanimator Chart web viewer

bible-local/architecture/runtime-flows.md

@@ -18,8 +18,10 @@ local-fs.target
   ├── bee-network.service    (starts `dhclient -nw` on all physical interfaces, non-blocking)
   ├── bee-nvidia.service     (insmod nvidia*.ko from /usr/local/lib/nvidia/,
   │                           creates /dev/nvidia* nodes)
-  └── bee-audit.service      (runs `bee audit` → /var/log/bee-audit.json,
-                               never blocks boot on partial collector failures)
+  ├── bee-audit.service      (runs `bee audit` → /var/log/bee-audit.json,
+  │                            never blocks boot on partial collector failures)
+  └── bee-web.service        (runs `bee web` on :80,
+                               reads the latest audit snapshot on each request)
 ```
 
 **Critical invariants:**
@@ -29,6 +31,7 @@ local-fs.target
   Reason: the modules are shipped in the ISO overlay under `/usr/local/lib/nvidia/`, not in the host module tree.
 - `bee-audit.service` does not wait for `network-online.target`; audit is local and must run even if DHCP is broken.
 - `bee-audit.service` logs audit failures but does not turn partial collector problems into a boot blocker.
+- `bee-web.service` binds `0.0.0.0:80` and always renders the current `/var/log/bee-audit.json` contents.
 - Audit JSON now includes a `hardware.summary` block with overall verdict and warning/failure counts.
 
 ## Console and login flow