Pick MkDocs + Material for docs.teemops.com, and write the priority-1 pages - #113

Summary

• Records D-13 in the roadmap: MkDocs + Material is the renderer for docs.teemops.com, deployed via Cloudflare Pages (mkdocs build, output site/). Fills in the choice D-10 deliberately deferred until section count and search actually bit.
• Adds mkdocs.yml, requirements.txt, and the one CSS override the IA's own sample test found necessary (p:has(img) { max-width: none }, so the 900px diagrams aren't capped by the theme's prose measure).
• Adds a docs job to .github/workflows/tests.yml: mkdocs build --strict, the existing relative-link checker, and the SVG validator — a broken nav entry or dead cross-reference now fails CI instead of shipping to docs.teemops.com.
• Writes the six pages the IA's inventory marks priority 1 and weren't yet written: what TOPS is, install, connect your first AWS account, run your first scan, the security model, reporting a vulnerability. Combined with the four pages already on develop, this closes the entire evaluator + first-run priority-1 set (10 of 34 planned pages).
• Sourced from the actual UI copy (NewScanModal.vue, Scans/Index.vue), the roadmap's decisions log (D-1, D-2, D-9), docs/PROGRESS.md, and SECURITY.md — deliberately not docs/architecture.md, which is stale and still describes the pre-pivot hosted-SaaS design (Firebase as sole auth, encrypted ARNs, EC2/RDS deployment).
• Deliberately doesn't document PCI, roles/permissions (open inconsistency, roadmap X-5), MFA, report export, or scheduled scans — none are built per docs/PROGRESS.md.

Not in this PR

• Connecting the actual Cloudflare Pages project to docs.teemops.com — needs dashboard access this repo can't provide. Standard flow once ready: Workers & Pages → connect this repo → branch develop (or wherever this merges to) → build command mkdocs build → output directory site.
• Trimming README.md's setup section to link into user-docs/ — the IA's own writing order puts this after an install page exists to link to, which it now does, but it's a separate change.

Test plan

• mkdocs build --strict — all 10 pages + homepage build clean, no broken nav
• user-docs/README.md's own link-checker — all relative cross-references resolve
• SVG validator — all three diagrams still parse as valid XML (unchanged, re-verified)
• YAML of .github/workflows/tests.yml and mkdocs.yml parses
• CI run on this PR (docs job is new — first real run is this PR)
• Manual look at the rendered site — not possible until Cloudflare Pages is connected; reviewer may want to run mkdocs serve locally

Made with Cursor