chore(docs+devops): cross-module doc sync + sprint archival moves + compose updates

Bundled pre-session doc + ops work:
- docs/modules/**: sync across advisory-ai, airgap, cli, excititor,
  export-center, findings-ledger, notifier, notify, platform, router,
  sbom-service, ui, web (architectural + operational updates)
- docs/features/**: updates to checked excititor vex pipeline,
  developer workspace, quick verify drawer
- docs top-level: README, quickstart, API_CLI_REFERENCE, UI_GUIDE,
  code-of-conduct/TESTING_PRACTICES updates
- docs/qa/feature-checks/: FLOW.md + excititor state update
- docs/implplan/: remaining sprint updates + new Concelier source
  credentials sprint (SPRINT_20260422_003)
- docs-archived/implplan/: 30 sprint archival moves (ElkSharp series,
  misc completed sprints)
- devops/compose: .env + services compose + env example + router gateway
  config updates

File-level granularity preserved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/qa/feature-checks/state/excititor.json

@@ -1,7 +1,7 @@
 {
   "module": "excititor",
   "featureCount": 18,
-  "lastUpdatedUtc": "2026-02-13T20:00:00Z",
+  "lastUpdatedUtc": "2026-04-22T08:08:08.8206436Z",
   "features": {
     "vex-claim-normalization": {
       "status": "done", "tier": 2, "retryCount": 0, "sourceVerified": true, "buildVerified": true, "e2eVerified": true,
@@ -53,9 +53,9 @@
     },
     "vex-source-registration-and-verification-pipeline": {
       "status": "done", "tier": 2, "retryCount": 0, "sourceVerified": true, "buildVerified": true, "e2eVerified": true,
-      "skipReason": null, "lastRunId": "run-001", "lastUpdatedUtc": "2026-02-13T20:00:00Z",
+      "skipReason": null, "lastRunId": "run-003", "lastUpdatedUtc": "2026-04-22T08:08:08.8206436Z",
       "featureFile": "docs/features/checked/excititor/vex-source-registration-and-verification-pipeline.md",
-      "notes": ["[2026-02-13T20:00:00Z] done: run-001 Tier 0/1/2d passed. 73/73 Worker.Tests passed. VexWorkerHostedService, DefaultVexProviderRunner, WorkerSignatureVerifier, VexWorkerPluginCatalogLoader verified."]
+      "notes": ["[2026-04-22T08:08:08.8206436Z] done: run-003 re-verified the Oracle branch of the live VEX source registration pipeline. Tier 0 confirmed the Oracle CSAF connector, catalog loader, targeted test classes, and default provider seeding under src/Concelier. Tier 1 targeted xUnit helper runs passed for OracleCatalogLoaderTests (3/3) and OracleCsafConnectorTests (4/4). Tier 2 disposable Oracle worker run 5fa3edb0-a3af-4ec1-b9bb-dce9baa32d09 completed successfully against the live RSS catalog, skipped multiple historical 404 CSAF URLs without failing, and preserved last_updated=2026-04-22 06:46:15.261191+00 with docs=1 and failure_count=0."]
     },
     "excititor-vex-observation-and-linkset-stores": {
       "status": "done", "tier": 2, "retryCount": 0, "sourceVerified": true, "buildVerified": true, "e2eVerified": true,