feat(studio): carousel size lock, store-actionable today stories, HTTPS MCP suggestions in settings (v0.36.0)

Three concrete changes against operator feedback that the
Today carousel was visually jumping when arrowed and
genre-mixing platform-architecture education with store-
actionable highlights.

- Carousel size pinned. The hero's outer Container picks up
  `BoxConstraints(minHeight: 240)` so a slide with one
  paragraph and a slide with three render at the same
  height. Prev/next no longer reflows the rest of the page.

- Today fallback stories trimmed and re-themed. The four
  shipped slides drop to three:
  - "Public sources" (DeepWiki / Semgrep one-click) — kept
  - "Three text modules already in the store" — new,
    points the operator at text.extract / text.summarize /
    text.translate in the grid below
  - "Try the extract → summarize flow" — new, points at
    flows/extract-summarize.yaml
  Architecture-education stories (sandbox model, hash-
  chained audit, air-gap posture) are gone from this surface
  — they belong on the Welcome page that
  `docs/landing-page-design.md` lays out.

- DeepWiki + Semgrep added to the Settings → MCP-Clients
  add-server suggestion-chip catalogue. Until now the chips
  were nine stdio servers that need Node + npx; the two
  HTTPS public sources only existed as one-click cards in
  the Today hero. Operators who dismissed the hero had no
  in-Settings path to find them. The new entries sit at the
  top of the catalogue with an explicit "Public HTTPS — no
  Node, no API key" descriptor and the same icons the Today
  hero already uses.

- `docs/landing-page-design.md` (new). Captures the design
  for a sidebar Welcome page that hosts the three-pillar
  intro, the trust-posture deck, the getting-started
  checklist, and an embedded-doc reader so operator-facing
  documentation stays inside Studio (`flutter_markdown`
  rendering of bundled `assets/docs/*.md`) instead of
  clicking out to a browser. Three-phase implementation
  plan: scaffolding, embedded docs, computed checklist.
  Build is gated on operator alignment; this doc is the
  alignment artefact.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/widgets/fai_settings_dialog.dart

@@ -1403,6 +1403,27 @@ class _McpSuggestion {
 }
 
 const _kMcpSuggestions = <_McpSuggestion>[
+  // ── HTTPS / streamable-HTTP servers (no Node, no API key) ──
+  // Same set Studio promotes as one-click cards in the Today
+  // hero — listed here so the operator finds them even after
+  // the hero gets dismissed.
+  _McpSuggestion(
+    name: 'deepwiki',
+    icon: Icons.menu_book_outlined,
+    endpoint: 'https://mcp.deepwiki.com/mcp',
+    apiKeyEnv: '',
+    description:
+        'Public HTTPS — GitHub repo documentation search (AI-powered). No Node, no API key.',
+  ),
+  _McpSuggestion(
+    name: 'semgrep',
+    icon: Icons.security,
+    endpoint: 'https://mcp.semgrep.ai/mcp',
+    apiKeyEnv: '',
+    description:
+        'Public HTTPS — security scanning for code vulnerabilities. No Node, no API key.',
+  ),
+  // ── stdio servers (require Node + npx) ───────────────────
   _McpSuggestion(
     name: 'filesystem',
     icon: Icons.folder_outlined,