docs(user-docs): Mecatl Studio web UI deployment page

[samuv]

Summary

Adds user-docs/building/deployment/studio.md: the signed ghcr.io/stacklok/mecatl/studio image, what Studio offers per deployment capability, the local Compose quick start, the mecak8s deployment with OIDC browser login (public URL, session secret, trusted proxy hops, resource URL), the static-token and no-authentication opt-in, the environment reference (including the two activity-replay bounds STUDIO_ACTIVITY_REPLAY_MAX and STUDIO_ACTIVITY_MAX_STREAMS), and troubleshooting. Linked from the deployment overview, the intro, and the install page, and registered as the canonical page in user-docs/_README.md.

This layer closes the same-PR documentation rule at stack granularity, as docs/acceptance/studio-bootstrap.md recorded.

Verification

task site:build and task docs pass.

Early access

The page opens with a warning that Studio is early access: its interface, /api/v1 endpoints, configuration, and browser-stored data can change in any release with no deprecation period, so deployments should pin an exact tag rather than latest. The deployment index, the intro, and the install page label the entry the same way.

Further amendments

• MECATL_RESOURCE_URL is now described as the canonical resource identifier that must equal the published resource, with a troubleshooting entry for auth_discovery_invalid.
• A troubleshooting entry covers the new 421 Host not allowed answer, and the page says the ingress must pass the original Host through.
• The configuration table gains STUDIO_HOST, and the rate-limit row describes what is actually counted.
• "Mecatl" is capitalised consistently.
• Image verification. The page now carries the cosign verify and gh attestation verify commands, instead of linking a workflow README that had none.
• README. apps/README.md now covers only local development and links the public page for deployment, configuration, the image, and security. This also removes a stale description of the CSRF rule.

Development stage

• Plan / Interface
• Implementation
• Combined
• Spike / Routine / Cleanup

Contract linkage

• Work classification: Routine
• Classification rationale: documentation of shipped behavior
• Decision record: None — documents shipped behavior
• Human waiver of spine: Yes — the directing human chose stacked (gh stack) delivery for the whole Studio series: nothing merges until every layer is reviewed, so the plan's approval-by-merge event is deferred to the end (recorded in each plan's Delivery line), and each implementation layer records the exact plan commit it built against.
• Acceptance plan: N/A — the user-docs/ page is the recorded top layer of the stack (see docs/acceptance/studio-bootstrap.md, Human decisions)
• Human decisions resolved and recorded: N/A — no plan
• Plan / Interface PR: N/A
• Approved commit baseline: N/A
• Combined/exemption rationale: N/A

Interface conformance

• N/A — documentation of the behavior the layers below ship.

Issue relationship

Relates to #1752 (parent #1736; stack #1766). Non-closing: the step completes when both of its layers merge.

Type of change

• Behavioral/interface plan
• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation/process

Test plan

Baseline checks

• Acceptance-plan checker
• Linting (task lint)
• Offline test suite (task test)
• Offline demo (go run ./cmd/mecademo)
• Markdown changed: docs generation/link checks (task docs)
• User docs/user-facing behavior changed: site build (task site:build)

User-facing change

A new documentation page: Mecatl Studio web UI (deployment).

Special notes for reviewers

Part of a fourteen-layer stack; review bottom-up. Nothing merges until the whole series is reviewed.