feat: documentation site

Docusaurus 3 docs-only site at docsite/, served statically by nginx under
/docs on the marketing host. Covers getting started (self-hosted install
through first server and first licence), the control plane, Vantage HQ,
a reference section and operations.

Wired into docker-compose.site.yml as docsite (3005:80) and into the
image build workflow, rebuilding on its own directory only. Never added
to the self-hosted compose file.

docs/vantage/audit-log.md

@@ -0,0 +1,51 @@
+---
+id: audit-log
+title: Audit log
+sidebar_label: Audit log
+---
+
+Every mutating API path writes an audit event. The log is at **Audit**.
+
+## What an event carries
+
+| Field | Meaning |
+| --- | --- |
+| Action | A dotted name, e.g. `server.created`, `settings.updated` |
+| Actor | Who did it |
+| Target | The object acted on |
+| Detail | A short human-readable note |
+| Time | When |
+
+## What is recorded
+
+Creation, modification and deletion across the product: servers and enrolments,
+keys and assignments, workflow and step changes, runs triggered, monitors and
+channels, secret groups and reveals, console sessions opened, settings and
+member changes, licence installs.
+
+Reads are not recorded, with one deliberate exception: **revealing a secret**
+writes an event, because reading that particular thing is an act rather than a
+lookup.
+
+## What is not recorded
+
+- Sign-ins and sign-out.
+- Anything inside a console session.
+- Step output. That lives in the run log, kept under the workflow retention
+  setting rather than with the audit log.
+
+## Retention
+
+Audit events are not swept by the workflow log retention setting — that setting
+governs run logs only. Audit history stays until the instance does.
+
+:::warning It is a log, not a control
+The audit log tells you what happened. It does not restrict what can happen, and
+an admin can do anything an admin can do. Use roles for restriction and the log
+for accountability.
+:::
+
+## Getting events out
+
+`GET /api/audit` returns recent events as JSON and accepts a `limit`. There is
+no streaming or push export; if you need events in a SIEM, poll that endpoint.