feat: documentation site

Docusaurus 3 docs-only site at docsite/, served statically by nginx under
/docs on the marketing host. Covers getting started (self-hosted install
through first server and first licence), the control plane, Vantage HQ,
a reference section and operations.

Wired into docker-compose.site.yml as docsite (3005:80) and into the
image build workflow, rebuilding on its own directory only. Never added
to the self-hosted compose file.

docs/hq/free-tier.md

@@ -0,0 +1,79 @@
+---
+id: free-tier
+title: Free tier
+sidebar_label: Free tier
+---
+
+Free is a real tier in both deployments — not a trial that turns into nothing.
+
+## What you get
+
+| | Free |
+| --- | --- |
+| Servers | 3 |
+| Monitors | 3 |
+| Secret groups | 1 |
+| Notification channels | 1 |
+| Audit retention | 30 days |
+| Support | Community |
+
+Browser console and single sign-on are not included; they are per-instance
+features on a paid plan.
+
+## One per account, per deployment
+
+The limit is enforced per account **and** deployment. A Free cloud instance does
+not prevent a Free self-hosted one — they are separate slots.
+
+## Free is outside Paddle
+
+There is no subscription, no £0 line item and no invoice. Your account acquires
+a Paddle customer reference only with its first paid purchase.
+
+## Renewing
+
+Free licences have a term and must be renewed from the portal.
+
+- The renew button appears **7 days before expiry**.
+- It stays available **after** expiry, right up until the instance is reaped —
+  so the same button rescues a lapsed instance rather than needing a second
+  mechanism.
+- Renewing outside that window is refused, and the message names the date it
+  opens.
+
+:::tip Put the expiry in a calendar
+Warning emails go to the account address. If nobody watches that inbox, a Free
+cloud instance can lapse and eventually be deleted without anyone noticing.
+:::
+
+## What happens when it lapses
+
+**Self-hosted:** the instance goes into degraded mode after the grace period and
+stays that way. Nothing is deleted, ever — the reaper is disabled by default on
+a self-hosted install and must stay that way.
+
+**Cloud:** the instance goes into degraded mode, and after a further period the
+instance **and all its data are deleted**. Warning emails are sent first, naming
+the date.
+
+:::danger Deletion is permanent
+There is no restore. If a cloud Free instance is approaching that date and you
+want to keep it, renew it, or move it to a paid plan.
+:::
+
+Deletion is carried out by the control plane rather than by HQ. HQ sends the
+warnings because it knows the billing address; the control plane performs the
+delete because it is the only service that knows which collections carry the
+instance ID.
+
+## Moving off Free
+
+Change the instance's configuration to a paid tier and check out. Your data
+stays where it is — a tier change reissues a licence, it does not rebuild
+anything.
+
+## Relinks
+
+Free instances get the same relink allowance as paid ones: three per term. That
+cap exists to put a human in front of a fourth attempt, not to obstruct a
+genuine rebuild.