docs: UI-driven local setup sprints + module dossier sync

Add SPRINT_20260413_004 (platform UI-only setup bootstrap closure)
with BOOTSTRAP-001..006 delivery tracker, and update sprint 003 and
sprint 20260410-001 execution logs to reflect the completed
persistence / orchestrator / secret-authority work.

Sync module dossiers and operator guides with the new reality: setup
wizard UX, platform-service architecture, CLI setup guide, integrations
architecture + local services, release-orchestrator architecture,
install guide, and compose README.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/setup/setup-wizard-ux.md

@@ -21,6 +21,38 @@ This document defines the user experience flows for both CLI and UI implementati
 | **Fix** | A remediation command generated by Doctor |
 | **Connector** | A specific integration provider (e.g., "HashiCorp Vault") |
 
+### 1.3 Current implemented boundary (2026-04)
+
+The live browser wizard is now intentionally narrower than some of the broader
+design material later in this document.
+
+- The implemented UI bootstrap flow persists authoritative installation-scoped
+  state in `platform.setup_sessions`.
+- The current live step inventory is limited to the five control-plane steps
+  the running platform can truthfully validate and converge:
+  `database`, `cache`, `migrations`, `admin`, and `crypto`.
+- `probe` and `apply` are now distinct backend operations. Successful probes do
+  not complete steps.
+- `stella setup` is a backend-authoritative client for the same
+  installation-scoped setup session APIs rather than a separate local state
+  machine.
+- Repeatable tenant onboarding work such as integrations, notifications,
+  advisory sources, environments, agents, and branding lives on `/setup/*`
+  and other authenticated module surfaces, not inside the bootstrap wizard.
+- Secret material is no longer an out-of-band prerequisite for GitLab-class UI
+  onboarding. The Integrations Hub can stage credentials through the Secret
+  Authority API and then bind the returned `authref://...` URI to the created
+  integration.
+- The live verification harness is
+  `src/Web/StellaOps.Web/scripts/live-setup-wizard-state-truth-check.mjs`.
+- The live integrations harness is
+  `src/Web/StellaOps.Web/scripts/live-integrations-ui-bootstrap.mjs`; it can
+  exercise inline GitLab secret staging when the operator supplies the raw
+  credential values through environment variables.
+- Sections below that describe broader multi-connector or tenant-onboarding
+  flows remain product/backlog design material unless they are explicitly
+  called out elsewhere as shipped.
+
 ---
 
 ## 2. CLI Flow