docs: UI-driven local setup sprints + module dossier sync

Add SPRINT_20260413_004 (platform UI-only setup bootstrap closure)
with BOOTSTRAP-001..006 delivery tracker, and update sprint 003 and
sprint 20260410-001 execution logs to reflect the completed
persistence / orchestrator / secret-authority work.

Sync module dossiers and operator guides with the new reality: setup
wizard UX, platform-service architecture, CLI setup guide, integrations
architecture + local services, release-orchestrator architecture,
install guide, and compose README.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/INSTALL_GUIDE.md

@@ -171,6 +171,56 @@ docker compose -f docker-compose.stella-ops.yml ps
 curl -k https://stella-ops.local    # should return the Angular UI
 ```
 
+After the Angular UI is reachable, the supported local operator lanes are:
+
+### Browser-driven operator lane
+
+Use the live browser UI at `https://stella-ops.local` and open the
+Integrations Hub at `/setup/integrations`.
+
+For a repeatable browser-driven run against the live frontdoor:
+
+```powershell
+node src/Web/StellaOps.Web/scripts/live-integrations-ui-bootstrap.mjs
+```
+
+This harness signs in through the same frontdoor flow, drives the
+`/setup/integrations/onboarding/*` routes in a real browser, and writes
+evidence to
+`src/Web/StellaOps.Web/output/playwright/live-integrations-ui-bootstrap.json`.
+
+For a repeatable browser-driven proof of the setup wizard’s truthful state model:
+
+```powershell
+node src/Web/StellaOps.Web/scripts/live-setup-wizard-state-truth-check.mjs
+```
+
+This harness signs in through the frontdoor, forces a fresh installation-scoped
+setup session, proves that database probe does not complete the step, proves
+that apply advances the backend state to the cache step, and proves that a page
+reload resumes the same persisted session. Evidence is written to
+`src/Web/StellaOps.Web/output/playwright/live-setup-wizard-state-truth-check.json`.
+
+Verified current UI boundary on `2026-04-14`:
+- The browser flow can create the full 16-entry local integration catalog.
+- GitLab-class providers can now be created from the UI without a manual Vault
+  write because the Integrations Hub stages credentials through Secret
+  Authority before binding the returned `authref://...`.
+- The setup wizard now persists authoritative installation-scoped progress in
+  `platform.setup_sessions` and owns only the five control-plane steps the
+  running control plane can truthfully converge: PostgreSQL, Valkey, schema
+  migrations, admin bootstrap, and crypto profile.
+- Tenant-scoped onboarding stays on `/setup/*` and other authenticated module
+  surfaces instead of being duplicated inside the bootstrap wizard.
+- The inline GitLab path still needs real credential input from the operator.
+  For repeatable automation, the Playwright harness reads those values from
+  `STELLAOPS_UI_BOOTSTRAP_GITLAB_ACCESS_TOKEN` and
+  `STELLAOPS_UI_BOOTSTRAP_GITLAB_REGISTRY_BASIC`.
+- `scripts/bootstrap-local-gitlab-secrets.ps1` remains the scripted fallback
+  when you want to pre-stage the local GitLab authrefs without using the UI.
+
+### Scripted convergence lane
+
 For a fresh local developer install, populate the live integration catalog with:
 
 ```powershell