Rewrite architecture docs and add Vexer connector template

docs/ops/feedser-certbund-operations.md

@@ -1,6 +1,6 @@
 # Feedser CERT-Bund Connector Operations
 
-_Last updated: 2025-10-15_
+_Last updated: 2025-10-17_
 
 Germany’s Federal Office for Information Security (BSI) operates the Warn- und Informationsdienst (WID) portal. The Feedser CERT-Bund connector (`source:cert-bund:*`) ingests the public RSS feed, hydrates the portal’s JSON detail endpoint, and maps the result into canonical advisories while preserving the original German content.
 
@@ -96,18 +96,30 @@ curl -s -b cookies.txt \
 
 Iterate `page` until the response `content` array is empty. Pages 0–9 currently cover 2014→present. Persist JSON responses (plus SHA256) for Offline Kit parity.
 
+> **Shortcut** – run `python tools/certbund_offline_snapshot.py --output seed-data/cert-bund`
+> to bootstrap the session, capture the paginated search responses, and regenerate
+> the manifest/checksum files automatically. Supply `--cookie-file` and `--xsrf-token`
+> if the portal requires a browser-derived session (see options via `--help`).
+
 ### 3.3 Export bundles
 
 ```bash
-curl -s -b cookies.txt \
-     -H "Accept: application/json" \
-     -H "X-XSRF-TOKEN: ${XSRF}" \
-     "https://wid.cert-bund.de/portal/api/securityadvisory/export?format=json&from=2020-01-01" \
-     > certbund-2020-2025.json
+python tools/certbund_offline_snapshot.py \
+  --output seed-data/cert-bund \
+  --start-year 2014 \
+  --end-year "$(date -u +%Y)"
 ```
 
-Split long ranges per year and record provenance (`from`, `to`, SHA, capturedAt). Feedser can ingest these JSON payloads directly when operating offline.
-Task `FEEDCONN-CERTBUND-02-009` tracks turning this workflow into a shipped Offline Kit artefact with manifests and documentation updates—coordinate with the Docs guild before publishing.
+The helper stores yearly exports under `seed-data/cert-bund/export/`,
+captures paginated search snapshots in `seed-data/cert-bund/search/`,
+and generates the manifest + SHA files in `seed-data/cert-bund/manifest/`.
+Split ranges according to your compliance window (default: one file per
+calendar year). Feedser can ingest these JSON payloads directly when
+operating offline.
+
+> When automatic bootstrap fails (e.g. portal introduces CAPTCHA), run the
+> manual `curl` flow above, then rerun the helper with `--skip-fetch` to
+> rebuild the manifest from the existing files.
 
 ### 3.4 Connector-driven catch-up