docs(architecture): restore pivot cleanup details

[jmgilman]

Summary

• restore day-0 bootstrap ordering details for the platform-bootstrap AppProject and root Application
• clarify the IncusOS Operation image path for the single-disk UM760 bootstrap
• update secrets/PKI and Keycloak architecture status to match completed foundations and current Traefik runtime

Testing

• moon run docs:check
• git diff --check
• rg confirmed stale architecture wording for "root must be recreated" and "Caddy or equivalent" is gone

Notes

• RouterOS CA migration remains deferred and out of scope for this PR.
• Reverted generated docs/package-lock.json churn from the validation run.