feat(site): add the documentation site for lfsx.dev

[BryanFRD]

The documentation site for lfsx.dev, built the way the other FerrLabs sites
are: Analog, prerendered static, consuming @ferrlabs/ui-ng for the chrome and
@ferrlabs/ui-ng/docs for the docs layout.

One source, two renderings

The README was 985 lines and held everything: configuration, auth, buckets,
encryption, locking, Kubernetes. Copying that into the site would have created
two versions of the same prose that disagree within a fortnight.

Instead the long-form sections moved into docs/, one file per topic, still
readable on GitHub and still linked from the README. site/scripts/sync-docs.mjs
derives the site's content from them at build time: it adds the frontmatter,
lifts the description from the page's own first paragraph, and rewrites
reclaiming-space.md (a sibling file on GitHub) into /docs/reclaiming-space (a
route here). Links pointing out of docs/ become GitHub links, because the site
has no copy of chart/README.md.

The split was mechanical and checked: every section body is byte-identical to
what the README held, and every relative link in README.md and docs/ resolves
to a file that exists.

The README is now 193 lines — what it is, why, quick start, and where to read the
rest.

What is in it

25 prerendered pages: the landing, a 404, and 23 doc pages, wired into a
six-section sidebar. Adding a page to docs/ prerenders it: vite.config.ts
reads the directory rather than carrying a list, so the two cannot disagree.

Two things worth knowing

The language switcher points at a page that does not exist. The shared navbar
renders EN/FR from SITE_LOCALES, a constant in @ferrlabs/ui-ng, and
SiteChromeConfig has no way to say "this site has one locale". So the site
currently offers /fr/, which would 404. The repo rule is to add the option to
the UI library rather than inline a local navbar, so that is a FerrLabs/UI PR
and this site should not be deployed until it lands. Everything else is
ready.

Analog prerenders the whole site twice. With the default locale in the
plugin's locales, every page is emitted again under /en/, each canonical to
itself. That is 50 files for 25 routes, and duplicate content is the last thing a
site built to be found wants. Passing only the non-default locales fixes it here.
ferrflow.com has the same duplication today (/en/ exists, self-canonical) —
filed separately, not touched here.

Verified

• pnpm typecheck clean
• pnpm build produces exactly 25 pages, no /en/ duplicates
• landing and doc pages render in the browser with the sidebar, no console errors
• Check Site job added, on ferrlabs-k8s-large with a 4 GB heap, because the
  prerender outgrows the default runner

Nothing points at https://lfsx.dev yet outside the site's own chrome: the Cargo
homepage, Chart.yaml home and the GitHub homepage field stay on the
repository until the domain is registered and this is deployed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[ferrfleet]

Reviewed the docs-site scaffolding: sync-docs.mjs, vite.config.ts, CI job, Dockerfile, nginx.conf, site-chrome/nav/routing. Spot-checked the README/docs split for mechanical correctness (config claims byte-identical move, and file listing matches).

Nothing blocking:

• vite.config.ts reads doc slugs from src/content/docs-en at build time, and prebuild/predev scripts correctly run sync:docs first, so the ordering is sound.
• docs-nav.ts references clients and operations slugs not touched by this PR — confirmed both docs/clients.md and docs/operations.md already exist on the branch, so these aren't dead links.
• nginx 403→404 mapping and BuildKit secret handling for the private registry token are both well-reasoned (good comments explaining non-obvious behavior).
• The two known gaps (FR language switcher 404, this site not to be deployed yet) are clearly called out in the PR description and gated by a separate UI-library PR — not this PR's problem to fix.

Nit: sync-docs.mjs's doc-link rewrite regex \]\(([a-z0-9-]+)\.md\) only matches lowercase-hyphen filenames — fine today since all docs/*.md files follow that convention, but would silently fail to rewrite a link to a future file that doesn't (e.g. uppercase or underscore). Not worth blocking on given the existing convention.

[github-actions]

SonarQube — 4 issue(s) introduite(s) par cette PR

• MAJOR site/scripts/sync-docs.mjs L53 — Simplify this regular expression to reduce its runtime, as it has super-linear performance due to backtracking. _{javascript:S8786}
• MAJOR site/src/app/components/landing.component.css L46 — Text does not meet the minimal contrast requirement with its background. _css:S7924
• MAJOR site/src/main.ts L6 — Prefer top-level await over using a promise chain. _{typescript:S7785}
• MINOR site/scripts/sync-docs.mjs L37 — Prefer String#replaceAll() over String#replace(). _{javascript:S7781}

_{Comparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail}