docs: server tags and workflow tag targeting

docs/vantage/servers.md

@@ -26,6 +26,52 @@ The offline sweep runs every two minutes, so a machine that has just gone away
 takes a little while to be marked as such. That delay is intentional a single
 missed poll is not an outage.
 
+## Tags
+
+A tag is a `key:value` label you put on a server. Tags are how you say what a
+machine **is** `env:prod`, `role:web`, `team:core-infra` so that you can find
+it later, and so that a [workflow](./workflows.md) can target it without you
+naming it by hand.
+
+There is no tag library to manage first. A tag exists because a server carries
+it, and it stops existing when the last server carrying it drops it.
+
+### The rules
+
+| Rule       | Value                                             |
+| ---------- | ------------------------------------------------- |
+| Characters | lowercase letters, digits, `-` and `_`, on both halves |
+| Key length | up to 32 characters                               |
+| Value length | up to 64 characters                             |
+| Per server | up to 20 tags                                     |
+
+Neither half may be empty, and keys beginning `sys:` are reserved for tags
+Vantage may derive from inventory later, so a tag you write today can never
+collide with one invented for you tomorrow.
+
+Anything outside those rules is refused with a message naming the rule, rather
+than quietly saved in a shape you did not intend. Uppercase is not folded to
+lowercase for you `Env` is a mistake, not a synonym for `env`.
+
+### Editing a server's tags
+
+On the server detail page, **Edit** beside the tag chips. Saving replaces the
+whole set: what you see in the editor is exactly what the server will have.
+There is no per-tag merge, so if two people edit the same server at once, the
+last save wins outright rather than producing a blend of the two.
+
+### Filtering the fleet
+
+The **Servers** list has a picker per tag key in use. Choosing values from more
+than one key narrows the list a server must match **all** of them, not any.
+Untagged servers appear only when no filter is set.
+
+:::tip A filtered fleet view is a link
+The filter lives in the URL (`/servers?tag=env:prod&tag=role:web`). Copy the
+address bar and you have sent someone the same view, not a description of how to
+reproduce it.
+:::
+
 ## The server detail page
 
 ### Keys