fix: show the settings card, and make an edit actually take effect

`mode` and `extraRoots` carried no `volatile()` marker, so the framework's
form projection dropped the whole entry from `settings.describe` and the plugin
had no card under Plugins at all. The marker is what creates the card.

It is also what turns each field into a reference rather than a value: the
resolved config hands `apply` a `{get(), [write]}` per volatile field, which is
how a settings write lands in a running plugin without re-applying it. So the
policy and the guard now read both fields at the point of use instead of
snapshotting them at mount, and `sectionOrder`/`contextOrder` stay unmarked
because a prompt section cannot be re-ordered without a remount.

A section is also registered once as a plain string, so the rule could not
follow a live `mode` without freezing at load. The mode-specific sentence moved
into the binding, which is a callback.

README.md

@@ -115,6 +115,23 @@ The host row's config is where this deployment's facts belong — the profile's
       - ../../shared       # relative to each session's own directory
 ```
 
+Both fields are also on the plugin's card under **Plugins** in the Web UI, which
+is the same layer reached a different way: a settings write rewrites this entry in
+the profile patch rather than storing anything new. An edit there is live — the
+guard reads `mode` and `extraRoots` on every call, so a change decides the next
+file call without a restart.
+
+The one exception is `off`. Choosing it while a session is running stops the guard
+immediately and empties the binding on the next request, because the binding is a
+callback. The rule is not: it was registered at load as a plain string, and
+nothing unregisters it, so the prompt would go on stating a rule that nothing
+enforces. An `off` *deployment* is therefore settled at load — set it in the
+patch. `ask` and `deny` swap freely in both directions.
+
+`sectionOrder` and `contextOrder` are deliberately absent from the card. They
+place the rule and the binding among the other prompt sections, which is decided
+once at load, and no section is re-ordered without a remount.
+
 `extraRoots` is for code a module legitimately always depends on. Anything you
 grant by hand is per-conversation and is never persisted — "this session may
 also see `src/shared`" is a statement about one conversation, and writing it down
@@ -171,7 +188,7 @@ Honest boundaries, because each one is a decision rather than an oversight:
 
 Verified:
 
-- 42 tests (`npm test`) over the scope algebra, the policy state, and the guard —
+- 45 tests (`npm test`) over the scope algebra, the policy state, and the guard —
   including that containment is decided on canonical targets (a symlink inside
   the facet pointing outside it is refused), that a prefix is not a parent
   (`/a/room` does not contain `/a/roommate`), that a malformed tool call never
@@ -251,7 +268,7 @@ lib/scope.js                 the pure half — argument extraction, text, reason
 lib/guard.js                 preset row: rule, binding, tool, pre-execute guard
 presets/facet.patch.yml      the `facet` agent preset
 presets/standard-compaction.patch.yml   optional: the same budget for `standard`
-test/                        42 tests
+test/                        45 tests
 ```
 
 ## Also in this repository