feat: documentation site

Docusaurus 3 docs-only site at docsite/, served statically by nginx under
/docs on the marketing host. Covers getting started (self-hosted install
through first server and first licence), the control plane, Vantage HQ,
a reference section and operations.

Wired into docker-compose.site.yml as docsite (3005:80) and into the
image build workflow, rebuilding on its own directory only. Never added
to the self-hosted compose file.

docs/getting-started/first-login.md

@@ -0,0 +1,75 @@
+---
+id: first-login
+title: First login
+sidebar_label: First login
+---
+
+A fresh install has no users and no organisation. The first visit creates both.
+
+## 1. Bootstrap
+
+Open the control plane in a browser. Because no user exists, you land on
+`/setup`.
+
+Fill in:
+
+| Field | Notes |
+| --- | --- |
+| Organisation name | Display name. Shown throughout the UI |
+| Slug | Lowercase, used in the hostname on cloud. Some names are reserved |
+| Your name | |
+| Email | Becomes your sign-in identity |
+| Password | Stored bcrypt-hashed |
+
+Submitting creates the organisation and its **owner** — you.
+
+:::warning Bootstrap works exactly once
+The endpoint is open only while the database has no users. As soon as the first
+one exists, `/setup` redirects to the login page and the bootstrap endpoint
+refuses. There is no second chance to create the first owner, so record the
+credentials before you close the tab.
+:::
+
+## 2. Sign in
+
+You are taken to `/login`. Sign in with the email and password you just set.
+
+Sessions are an opaque 32-byte token in the `km_session` cookie, with the body
+held in Redis for 24 hours. Restarting Redis signs everyone out and loses
+nothing else.
+
+## 3. Look around
+
+You land on the fleet dashboard, which is empty. The sidebar is the whole
+product:
+
+| Section | What it does |
+| --- | --- |
+| Servers | The fleet — enrol, inspect, console, update |
+| Keys | SSH public keys and their assignments |
+| Workflows | Compose and run scripted work |
+| Steps | The reusable step library |
+| Monitors | HTTP, TCP, ICMP and TLS checks |
+| Secrets | The encrypted vault |
+| Audit | Every mutating action |
+| Settings | Members, SSO, alerts, retention, licence |
+
+## 4. Add the rest of your team
+
+Go to **Settings → Access**. Add members with a role:
+
+| Role | Can |
+| --- | --- |
+| `owner` | Everything, including billing-adjacent settings |
+| `admin` | Everything except owner-only settings |
+| `member` | Day-to-day work — servers, keys, workflows, monitors |
+
+Settings and organisation management require `owner` or `admin`.
+
+If you would rather not manage passwords, configure OIDC instead — see
+[Settings](../vantage/settings.md#single-sign-on-oidc). OIDC is configured per
+organisation, and the client secret is stored encrypted.
+
+## Next
+
+[Add your first server](./first-server.md).