chore: clean up pre-session dirt (Concelier source-credentials + Web advisory-sources + playwright artifacts)

Bundled cleanup of residue that straddled earlier commit boundaries:

- docs/modules/concelier/operations/source-credentials.md — SRC-CREDS-004
  doc update (credential acquisition + UI/CLI entry paths).
- src/Web/.../advisory-vex-sources/{advisory-source-catalog,
  source-management.api}.ts — SRC-CREDS-003 Web-side entry paths for
  persisted source configuration.
- src/Web/StellaOps.Web/output/playwright/* — refreshed live probe
  artifacts from setup-wizard bootstrap runs.
- src/Web/StellaOps.Web/docs/{ACCESSIBILITY_AUDIT_BINARY_RESOLUTION,
  DeterministicInstall, HelmReadiness, TrivyDbSettings}.md — deleted
  stale docs relocated to docs/modules/ in a prior migration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/modules/concelier/operations/source-credentials.md

@@ -29,6 +29,16 @@ Then:
 
 Sensitive fields never round-trip back to the browser. A stored secret is shown only as retained state. Leaving a password field blank keeps the retained secret. Explicitly checking the clear control removes the stored secret.
 
+### Blocked or sleeping sources
+
+If an operator enables a source that still lacks required credentials or required URIs, Concelier now preserves the enable intent but marks the source as `blocked` instead of pretending it is runnable.
+
+- `enabled=true` means the operator wants the source scheduled once it becomes usable.
+- `syncState=blocked` means the source is intentionally on hold because required configuration is still missing.
+- Manual or batch sync attempts will report that the source is blocked and will echo the missing-configuration reason, typically `SOURCE_CONFIG_REQUIRED`.
+
+This is the expected state for credential-gated sources that have been selected before the upstream token or client-secret values are available.
+
 ### CLI
 
 Inspect current persisted source configuration: