feat(advisory-ai): Add deployment guide, Dockerfile, and Helm chart for on-prem packaging

- Introduced a comprehensive deployment guide for AdvisoryAI, detailing local builds, remote inference toggles, and scaling guidance.
- Created a multi-role Dockerfile for building WebService and Worker images.
- Added a docker-compose file for local and offline deployment.
- Implemented a Helm chart for Kubernetes deployment with persistence and remote inference options.
- Established a new API endpoint `/advisories/summary` for deterministic summaries of observations and linksets.
- Introduced a JSON schema for risk profiles and a validator to ensure compliance with the schema.
- Added unit tests for the risk profile validator to ensure functionality and error handling.

docs/modules/concelier/operations/cache.md

@@ -31,6 +31,21 @@ Status: draft · aligned with LNM v1 (frozen 2025-11-17)
 - Timestamps use UTC ticks; content hashes retain upstream digest prefix (e.g., `sha256:`) to distinguish sources.
 - Cache TTL defaults to 0 (disabled) unless configured; safe for offline/air-gapped deployments.
 
+## Summary cache (for `/advisories/summary`)
+- Optional, disabled by default; enables deterministic paging for graph/console overlays.
+- Key material (pipe-delimited, normalized/sorted where applicable):
+  - `tenant`
+  - `purls[]` (sorted)
+  - `aliases[]` (sorted, lower-case)
+  - `sources[]` (sorted, lower-case)
+  - `confidence_gte`
+  - `conflicts_only`
+  - `sort`
+  - `take`
+  - `afterCursor` (opaque; includes last sort tuple)
+- Transparency headers (if enabled): `X-Stella-Cache-Key` (sha256-16), `X-Stella-Cache-Hit`, `X-Stella-Cache-Ttl`.
+- Ordering for cacheable results: `sort` (advisory|observedAt), then `advisoryKey`, then `linksetId`; cursor encodes the tuple to keep pagination stable when new linksets land.
+
 ## Testing notes
 - Unit coverage: `AdvisoryChunkCacheKeyTests` (ordering, filter casing) and `AdvisoryChunkBuilderTests` (observationPath pointers influence chunk IDs).
 - Integration tests should assert headers when cache is enabled; disable cache for tests that assert body-only determinism.
@@ -38,3 +53,4 @@ Status: draft · aligned with LNM v1 (frozen 2025-11-17)
 ## TODOs / follow-ups
 - Add integration test that exercises a cache hit path and validates transparency headers.
 - Document cache configuration knobs in `appsettings.*` once finalized.
+- Add summary cache integration test once `/advisories/summary` endpoint is implemented.