feat: documentation site

Docusaurus 3 docs-only site at docsite/, served statically by nginx under
/docs on the marketing host. Covers getting started (self-hosted install
through first server and first licence), the control plane, Vantage HQ,
a reference section and operations.

Wired into docker-compose.site.yml as docsite (3005:80) and into the
image build workflow, rebuilding on its own directory only. Never added
to the self-hosted compose file.

docs/hq/self-hosted-instances.md

@@ -0,0 +1,74 @@
+---
+id: self-hosted-instances
+title: Self-hosted instances
+sidebar_label: Self-hosted instances
+---
+
+A self-hosted instance is your install, licensed through HQ. HQ never touches
+it: it issues a signed file that your install verifies locally.
+
+## Free
+
+Install first, then link and claim. Step by step in
+[Claim a Free licence](../getting-started/claim-free-licence.md).
+
+## Paid
+
+Buying happens **before** the install has to exist, because you may well be
+buying in order to build it.
+
+```mermaid
+flowchart LR
+    A["Buy in HQ"] --> B["Placeholder instance<br/>awaiting_link, no licence"]
+    B --> C["Install Vantage<br/>get its instance UUID"]
+    C --> D["Paste the UUID<br/>claim-link"]
+    D --> E["Licence issued<br/>bound to that UUID"]
+```
+
+1. **Overview → Buy self-hosted**, choose tier, term and configuration.
+2. Complete checkout. HQ creates a **placeholder** instance in state
+   `awaiting_link` with no licence attached.
+3. [Install Vantage](../getting-started/self-hosted-install.md) if you have not
+   already, and find its instance UUID at **Settings → Licence**.
+4. Back in HQ, open the placeholder and paste the UUID.
+5. The licence is issued, bound to that UUID. Download it and paste it into your
+   install.
+
+:::info Why there is a placeholder at all
+A licence binds to an instance UUID, and at the moment of payment that UUID may
+not exist yet. Issuing early would mean issuing to nothing; refusing to sell
+until you had installed would be the wrong order. The placeholder holds the
+purchase until there is something to bind to.
+:::
+
+## Linking an existing install
+
+If the install already exists, **Link an instance** takes the UUID directly. A
+UUID already claimed by another account is refused with a conflict.
+
+## Relinking
+
+Rebuilding the host produces a new instance UUID, and the old licence no longer
+matches. **Relink** moves the licence to the new UUID and reissues.
+
+The number of relinks per term is capped, and the portal shows how many you have
+left. This is not meant to obstruct disaster recovery — if you have exhausted
+them for a real reason, ask support.
+
+## Installing the licence
+
+Paste it at **Settings → Licence** in your install. The instance verifies the
+signature and checks that the UUID matches its own.
+
+Pasting works even while the current licence is expired — that endpoint is
+exempt from the licence check, because it is the route out of degraded mode.
+
+## Keeping it current
+
+Your install does not fetch licences. When a licence is reissued — renewal,
+configuration change, relink — download the new one from HQ and paste it in.
+
+:::warning Nothing reminds your install
+The control plane knows only what its licence says. Expiry emails come from HQ,
+to the account's address. Make sure someone reads them.
+:::