docs: correct the status page URL for self-hosted, trim to what ships

- The status page URL was given only as `<instance>.vantage.<tld>`, which a
  self-hosted install does not serve. Both deployments are now described.
- The banner is documented as one notice: the editor exposes no level picker
  and the view renders every level identically.
- `pending` added to the component states, which a monitor with no result yet
  renders.
- Delete page documented alongside un-publish.
- `TRUSTED_PROXIES` names the LAN case: with the RFC1918 default, a client on a
  private range reaching the server directly is itself trusted and can spoof
  `X-Forwarded-For` — and now `X-Forwarded-Host`. Narrow it to the proxy.
- CLAUDE.md: scopes are nine resources, not eight; `status-pages` added to the
  REST route table; the host-resolution rules recorded under Status pages.

CLAUDE.md

@@ -503,6 +503,25 @@ with `available:false` and a `reason`, never a 403 or a blank page — the
 reader is a member of the public who can do nothing about either condition and
 deserves an explanation, not a browser error.
 
+**The instance is resolved from `X-Forwarded-Host`, not `Host`.** The public
+page is server-rendered by `web/`, and the SSR fetch cannot set `Host` at all:
+it is a forbidden header name and undici drops it silently, so the Go server
+saw `server:8080` and every status page 404'd on every deployment. `web/`
+forwards the visitor's host in `X-Forwarded-Host` (and their address in
+`X-Forwarded-For`, or the whole deployment shares one rate-limit bucket), and
+`publicStatusInstance` honours that header **only when `c.RemoteIP()` is in
+`TRUSTED_PROXIES`** — it selects a tenant, so an untrusted peer must not be
+able to name one. It uses `RemoteIP()` and not `ClientIP()` deliberately: the
+latter is reconstructed from the very headers being judged.
+
+**A host naming no slug falls back to the sole instance on a non-cloud
+deployment.** `hostSlug` requires `<slug>.vantage.<tld>`; a self-hosted install
+at `vantage.acme.com` or an IP has no slug and would otherwise 404 forever. It
+has exactly one instance, resolved with the same count-then-read bootstrap
+uses, cached alongside the slug lookups. More than one instance is a 404, not a
+guess. A host that *does* name a slug which does not exist stays a 404 —
+falling back there would serve one tenant's page on another's address.
+
 Assembled snapshots are cached in Redis for **30 seconds**, keyed per
 instance and page, and every authoring write (`UpdateStatusPage`,
 `DeleteStatusPage`, and every incident mutation) invalidates its page's entry
@@ -537,9 +556,9 @@ only as sha256 — the same shape as `servers.agent_token_hash` and the ESO read
 token, and for the same reason: nothing downstream ever needs the plaintext
 back. It belongs to the user who created it, and its role can never exceed
 theirs; see the `api_tokens` note under MongoDB Collections for how that stays
-true across a demotion rather than only at issuance. Scopes are eight
+true across a demotion rather than only at issuance. Scopes are nine
 resources — `servers`, `keys`, `secrets`, `workflows`, `monitors`, `vulns`,
-`workloads`, `settings` — each split into `:read` and `:write`, with `:write`
+`workloads`, `status`, `settings` — each split into `:read` and `:write`, with `:write`
 satisfying a `:read` requirement on the same resource so a caller does not have
 to hold both. Any signed-in member may mint and revoke their **own** tokens —
 there is no `RequireRole` on `POST /tokens` or `DELETE /tokens/:id` — because
@@ -818,6 +837,10 @@ workloads    GET /workloads · GET /servers/:id/workloads
              POST /servers/:id/workloads/refresh
              POST /servers/:id/workloads/:wid/action        (owner|admin)
              GET /servers/:id/workloads/:wid/logs           (owner|admin)
+status-pages GET,POST /status-pages · GET,PUT,DELETE /status-pages/:pageId  (owner|admin)
+             GET,POST /status-pages/:pageId/incidents
+             PUT,DELETE /status-pages/:pageId/incidents/:incidentId
+             POST /status-pages/:pageId/incidents/:incidentId/updates
 audit        GET /audit
 agent        GET /agent/latest-version
 settings     GET,PUT /settings · POST /settings/secrets-token       (owner|admin)