feat: documentation site

Docusaurus 3 docs-only site at docsite/, served statically by nginx under
/docs on the marketing host. Covers getting started (self-hosted install
through first server and first licence), the control plane, Vantage HQ,
a reference section and operations.

Wired into docker-compose.site.yml as docsite (3005:80) and into the
image build workflow, rebuilding on its own directory only. Never added
to the self-hosted compose file.

docs/hq/cloud-instances.md

@@ -0,0 +1,78 @@
+---
+id: cloud-instances
+title: Cloud instances
+sidebar_label: Cloud instances
+---
+
+A cloud instance is a Vantage control plane we run for you, reachable at
+`<your-slug>.vantage.hostxtra.co.uk`.
+
+## Creating one
+
+1. **Overview → New instance**.
+2. Choose a name and a slug.
+3. Create.
+
+The instance is provisioned with you as its owner, and a Free licence is issued
+immediately. The owner user inside it gets your HQ password hash **copied**, not
+shared — see [People and roles](./people-and-roles.md).
+
+### Slugs
+
+The slug becomes your hostname label, so it is lowercase, and some names are
+reserved. Pick something you can say on a phone call.
+
+:::warning One Free instance per account, per deployment
+Creating a second Free cloud instance is refused. If you want another, it needs
+a paid plan — or free up the first.
+:::
+
+## Using it
+
+Sign in at your instance's hostname with the email and password you use for HQ.
+It is a normal Vantage install from that point: see
+[Getting started](../getting-started/first-login.md) and the
+[Vantage](../vantage/servers.md) section.
+
+The instance does not depend on HQ at runtime. HQ being unreachable does not
+affect anyone signing in or any agent syncing.
+
+## The instance record
+
+Each instance on Overview is one record. Closed, it is a row. Open, it shows:
+
+- **Licence contents** — tier, server allowance, features, expiry.
+- **Members** — who has access and with what instance role.
+- **Actions** — grant access, change configuration, renew.
+
+## Members
+
+Granting access writes a real user into the instance. Covered fully in
+[People and roles](./people-and-roles.md).
+
+## Changing what it can do
+
+Server allowance and per-instance features (browser console, single sign-on) are
+part of the instance's **entitlement**. Changing it goes through billing — see
+[Licensing and entitlements](./licensing-and-entitlements.md) and
+[Billing](./billing.md).
+
+## Renaming
+
+The display name is free to change. The slug is the hostname and is not
+casually changed — ask support if you need it.
+
+## What happens if the licence lapses
+
+A cloud instance whose Free licence expires enters degraded mode, then, after a
+grace period, the instance and all its data are deleted. Warning emails go out
+first. See [Free tier](./free-tier.md).
+
+Paid instances do not get reaped by that mechanism. A cancelled subscription
+runs to its grace-padded expiry and then lapses.
+
+## Deleting
+
+Ask support. Deletion is performed by the control plane, not by HQ — the control
+plane is the only service that knows which collections carry the instance ID,
+and duplicating that list into HQ would be a list that drifts.