feat: documentation site

Docusaurus 3 docs-only site at docsite/, served statically by nginx under
/docs on the marketing host. Covers getting started (self-hosted install
through first server and first licence), the control plane, Vantage HQ,
a reference section and operations.

Wired into docker-compose.site.yml as docsite (3005:80) and into the
image build workflow, rebuilding on its own directory only. Never added
to the self-hosted compose file.

docsite/nginx.conf

@@ -0,0 +1,32 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Hitting the container directly is a 403 on an empty document root
+    # otherwise, which reads as a broken deploy rather than "wrong path".
+    location = / {
+        return 302 /docs/;
+    }
+
+    # Hashed assets are immutable — the filename changes when the content does.
+    location /docs/assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+
+    location /docs/ {
+        # Docusaurus emits a real page per route, so a miss is a genuine 404
+        # rather than something a SPA fallback should paper over.
+        try_files $uri $uri/ $uri.html /docs/404.html;
+    }
+
+    error_page 404 /docs/404.html;
+
+    gzip on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+    gzip_min_length 1024;
+}