Merge branch 'main' into feat/186-otel-endpoint

refs #173. This is the minimum step from the issue: the site is now **built** in CI, not **published**. Publishing still needs an ADR (Gitea has no built-in Pages) or a CLAUDE.md §12 correction, so the issue stays open.

- `make docs`: creates a throwaway `.venv-docs`, installs pinned `mkdocs==1.6.1` and `mkdocs-material==9.7.7`, then runs `mkdocs build --strict`. The target is also added to `make ci`.
- New `docs` job in `ci.yaml` (`setup-python@v5`, then `make docs`).
- Red, then green: the first commit fails on a link from `runbooks/ci.md` to a file outside `docs/`; the second turns that link into plain code.

**Dependency (§13):** mkdocs and mkdocs-material were already the site's declared toolchain (`mkdocs.yml`) but were never installed anywhere. They give a strict link/nav/theme check. Replacing them means writing our own Markdown link checker, and `check-docs-nav.py` already covers only the nav half. Risk: Material warns that MkDocs 2.0 drops its plugin/theme system, so both are pinned exactly. No ADR, since this adds no new decision beyond what `mkdocs.yml` already assumes.

Verified locally: `make docs` → `Documentation built in 0.87 seconds`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #189

.gitea/workflows/deploy.yaml

@@ -34,6 +34,9 @@ jobs:
       # `true` fills in the medewerker OTP step for the public demo (chart value
       # demo.otpAutofill). The fixture secret is committed: demo only.
       OTP_AUTOFILL: ${{ vars.OTP_AUTOFILL }}
+      # Tempo for the services' traces, e.g. http://tempo.monitoring.svc:4317 (the
+      # cluster monitoring stack, Infra repo). Empty = the chart default.
+      OTEL_ENDPOINT: ${{ vars.OTEL_ENDPOINT }}
     steps:
       - uses: https://github.com/actions/checkout@v4
 
@@ -100,7 +103,7 @@ jobs:
           make k8s-reseed \
             TALOS_HOST=${TALOS_HOST:-localhost} \
             K8S_REGISTRY=${TALOS_VM_IP:-192.168.122.173}:30500 \
-            K8S_SET="${KEYCLOAK_URL:+--set keycloakUrl=$KEYCLOAK_URL} --set demo.otpAutofill=${OTP_AUTOFILL:-false}"
+            K8S_SET="${KEYCLOAK_URL:+--set keycloakUrl=$KEYCLOAK_URL} --set demo.otpAutofill=${OTP_AUTOFILL:-false}${OTEL_ENDPOINT:+ --set otelEndpoint=$OTEL_ENDPOINT}"
 
       # `dev` is a mutable tag and helm sees an unchanged pod template, so the
       # new images only land on a restart (pullPolicy is already Always).

infra/helm/big-reference/values.yaml

@@ -30,6 +30,12 @@ host: 192.168.122.100
 # portals' authority (runbook, "Publishing through the labs Caddy").
 keycloakUrl: ""
 
+# Where the .NET services send traces (OTLP gRPC). The default is the chart's own
+# `tempo` workload (off by default, like compose). Point it at a Tempo outside the
+# release, e.g. the cluster monitoring stack's http://tempo.monitoring.svc:4317 —
+# with no Tempo at all, every export fails and is counted as a .NET exception.
+otelEndpoint: http://tempo:4317
+
 demo:
   # Fill in and submit the medewerker OTP step from the fixture secret, so a public
   # demo shows MFA enforced without an authenticator: makes the big-demo theme
@@ -160,10 +166,11 @@ envGroups:
     NOTIFICATIONS_DISABLED: "false"
     RUN_SETUP_CONFIG: "true"
 
-  # Traces for the .NET services. Always set, like compose: the exporter fails
-  # harmlessly when Tempo is absent (services/*/Program.cs).
+  # Traces for the .NET services. Always set, like compose. With no Tempo behind
+  # `otelEndpoint` the exporter fails quietly but throws on every batch, which
+  # shows up as HttpRequestException/SocketException in dotnet_exceptions_total.
   otel:
-    OTEL_EXPORTER_OTLP_ENDPOINT: http://tempo:4317
+    OTEL_EXPORTER_OTLP_ENDPOINT: '{{ .Values.otelEndpoint }}'
     OTEL_EXPORTER_OTLP_PROTOCOL: grpc
 
 # ── Workloads ──────────────────────────────────────────────────────────────────