chore(docs+devops): cross-module doc sync + sprint archival moves + compose updates

Bundled pre-session doc + ops work:
- docs/modules/**: sync across advisory-ai, airgap, cli, excititor,
  export-center, findings-ledger, notifier, notify, platform, router,
  sbom-service, ui, web (architectural + operational updates)
- docs/features/**: updates to checked excititor vex pipeline,
  developer workspace, quick verify drawer
- docs top-level: README, quickstart, API_CLI_REFERENCE, UI_GUIDE,
  code-of-conduct/TESTING_PRACTICES updates
- docs/qa/feature-checks/: FLOW.md + excititor state update
- docs/implplan/: remaining sprint updates + new Concelier source
  credentials sprint (SPRINT_20260422_003)
- docs-archived/implplan/: 30 sprint archival moves (ElkSharp series,
  misc completed sprints)
- devops/compose: .env + services compose + env example + router gateway
  config updates

File-level granularity preserved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/modules/web/architecture.md

@@ -237,6 +237,8 @@ Focused verification and bundle-polish notes for the shipped surfaces:
 - The lane intentionally covers the currently shipped Graph, Evidence, deployment creation, vulnerability detail, and environment-detail flows instead of the broader legacy spec backlog.
 - The setup wizard and step-content styling moved from oversized inline component styles into global SCSS under `src/Web/StellaOps.Web/src/styles/` so the production build clears `anyComponentStyle` budgets without raising those budgets.
 - Touched shipped routes continue to use explicit live empty/error/unavailable states rather than mock action fallbacks.
+- Shipped runtime DI stays live-only: app bootstrap and exported provider helpers must resolve HTTP/live clients, while any remaining mock implementations are restricted to test-local wiring or tracked retirement slices.
+- When a shipped Web surface does not yet have a live catalog, verifier, or stream endpoint, it must fail closed with an operator-visible unavailable state instead of fabricating successful data or simulated event traffic.
 
 ---