stela ops usage fixes roles propagation and timoeut, one account to support multi tenants, migrations consolidation, search to support documentation, doctor and open api vector db search

docs/modules/router/timelineindexer-microservice-pilot.md

@@ -0,0 +1,39 @@
+# Router TimelineIndexer Microservice Pilot
+
+## Scope
+- Pilot service: `TimelineIndexer` (`src/TimelineIndexer/StellaOps.TimelineIndexer/StellaOps.TimelineIndexer.WebService`).
+- Transport: `TransportType.Messaging` backed by Valkey.
+- Gateway entry under pilot: `/api/v1/timeline*`.
+
+## Baseline
+- Previous gateway route:
+- `ReverseProxy /api/v1/timeline -> http://timelineindexer.stella-ops.local/api/v1/timeline`
+- Reverse proxy mode strips the matched prefix before forwarding.
+- Microservice mode does not strip prefixes and routes by method+path identity.
+
+## Path Compatibility Mapping
+| External path | Reverse proxy behavior | Required microservice path | Pilot status |
+| --- | --- | --- | --- |
+| `/api/v1/timeline` | proxied to `/api/v1/timeline` upstream | `/api/v1/timeline` | converted |
+| `/api/v1/timeline/{eventId}` | proxied to `/api/v1/timeline/{eventId}` upstream | `/api/v1/timeline/{eventId}` | converted |
+| `/api/v1/timeline/{eventId}/evidence` | proxied to `/api/v1/timeline/{eventId}/evidence` upstream | `/api/v1/timeline/{eventId}/evidence` | converted |
+| `/api/v1/timeline/events` | proxied to `/api/v1/timeline/events` upstream | `/api/v1/timeline/events` | converted |
+| `/timelineindexer/*` | reverse-proxy prefix path for direct service access | unchanged (still reverse proxy) | unchanged |
+
+TimelineIndexer now exposes both native and gateway-alias endpoints:
+- native: `/timeline*`
+- gateway alias: `/api/v1/timeline*`
+
+## Compose Activation
+- Gateway messaging toggle: `ROUTER_GATEWAY_MESSAGING_ENABLED` (default `true`).
+- TimelineIndexer router toggle: `TIMELINE_ROUTER_ENABLED` (default `true`).
+- Compose env vars are applied on `timeline-indexer-web` (not `vexlens-web`) and mapped to:
+- `TimelineIndexer:Router`
+- `TimelineIndexer:Router:TransportPlugins:*`
+- `TimelineIndexer:Router:Messaging:*`
+- Valkey backend selection is environment-driven via `TimelineIndexer:Router:Messaging:Transport=valkey`.
+
+## Rollback
+1. Set `TIMELINE_ROUTER_ENABLED=false` and `ROUTER_GATEWAY_MESSAGING_ENABLED=false` in compose environment.
+2. Revert route entry in `devops/compose/router-gateway-local.json` from `Microservice` back to `ReverseProxy`.
+3. Re-deploy stack and verify `/api/v1/timeline*` responses through reverse proxy path.