chore(docs+devops): cross-module doc sync + sprint archival moves + compose updates

Bundled pre-session doc + ops work:
- docs/modules/**: sync across advisory-ai, airgap, cli, excititor,
  export-center, findings-ledger, notifier, notify, platform, router,
  sbom-service, ui, web (architectural + operational updates)
- docs/features/**: updates to checked excititor vex pipeline,
  developer workspace, quick verify drawer
- docs top-level: README, quickstart, API_CLI_REFERENCE, UI_GUIDE,
  code-of-conduct/TESTING_PRACTICES updates
- docs/qa/feature-checks/: FLOW.md + excititor state update
- docs/implplan/: remaining sprint updates + new Concelier source
  credentials sprint (SPRINT_20260422_003)
- docs-archived/implplan/: 30 sprint archival moves (ElkSharp series,
  misc completed sprints)
- devops/compose: .env + services compose + env example + router gateway
  config updates

File-level granularity preserved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/modules/ui/components/findings-list.md

@@ -224,11 +224,11 @@ export class AppModule {}
 ### Mock API for Testing
 
 ```typescript
-import { MockScoringApi } from '@app/core/services/scoring.service';
+import { FixtureScoringApi } from '@app/core/testing/scoring.testing';
 
 TestBed.configureTestingModule({
   providers: [
-    { provide: SCORING_API, useClass: MockScoringApi }
+    { provide: SCORING_API, useClass: FixtureScoringApi }
   ]
 });
 ```

docs/modules/ui/offline-operations/README.md

@@ -29,6 +29,7 @@
 ## UX Rules
 - `Offline Kit` owns bundle management, offline verification, and trust-material inspection.
 - `Feeds & Airgap` owns mirror freshness, version-lock posture, and air-gap entry actions.
+- `Feeds & Airgap` must expose a direct advisory/VEX source-management handoff in the page header so operators can correct stale or disconnected source state from the owner surface.
 - `Evidence Exports` remains Evidence-owned, but Offline Kit must link into it for portable bundle generation.
 - Single actions like `Import Bundle` and `Export Bundle` should not become standalone products; they route into a tabbed or action-aware owner page.