docs: audit and embed current product documentation

[jmagar]

Summary

• embed the repository documentation into Gateway Admin at /docs with deterministic build-time sync, safe Markdown rendering, search/navigation, and explicit historical/design/generated status metadata
• reconcile maintained documentation with current main across Access v8, Gateway/Upstream/OAuth, Discover/console alignment, callback relay operations, CLI help, Incus references, and current Labby naming
• modernize all maintained executable snippets against the live LABBY catalog, migrate independent fanout to codemode.batch, and make repo-context triage portable instead of defaulting to a Macpoo-only path
• harden documentation verification: GitHub-style fragment validation (ATX + Setext + Unicode + real fence lengths), service-index table coverage, orphan/current-vs-historical classification, and focused unit coverage
• harden the embedded-docs pipeline against unsafe manifest paths, overlapping source/output deletion, duplicate paths, malformed status metadata, cached v1 manifests, raw HTML/images, and unsafe URL schemes
• preserve valid repo-relative source/schema/config/script/directory links in the embedded viewer by routing non-embedded targets to canonical GitHub blob/main or tree/main URLs while keeping embedded Markdown navigation in-app

Verification

• just docs-check: 17 generated artifacts fresh; 647 local links; 63 Markdown fragments; 7 link-checker tests; 138 canonical docs; 24 maintained planning/feature docs; 2 service-index tests; 5 Depot contract tests
• Gateway Admin declared runtime: Node 22.18.0
• pnpm test:unit: 1,067 / 1,067 tests passed
• pnpm lint: passed
• mock-auth production export + focused Playwright /docs regression: passed at 390px viewport, including repo-relative source-link rewriting
• clean production export rebuilt afterward; route bundle budgets and static navigation build-id checks passed
• production /docs auth-boundary smoke: passed; docs content is not exposed before authentication
• cargo fmt --all -- --check: passed
• git diff --check: passed
• all five maintained snippets pass labby snippets validate; representative live LABBY calls were also re-exercised against current schemas

Notes

The callback-relay runbook now records the deployed topology and keeps the 2026-09-16 public 502 as a dated point-in-time verification note. This PR does not repair that unrelated runtime incident.