v0.17.0

What's Changed

• feat(appliance): in-VM Traefik router — unified HTTP ingress (ADR-105 step 1) by @aaronsb in #517
• feat(appliance): Traefik TLS cert path — EXTERNAL_URL + 4 cert modes (ADR-105) by @aaronsb in #518
• docs: consolidate 154 docs → 47 pages (Diátaxis taxonomy + voice guide + generated reference) by @aaronsb in #519
• docs(adr): normalize ADR frontmatter + enforce the decision graph by @aaronsb in #520
• docs(adr): renumber legacy ADRs into domain bands; retire the 1–99 range by @aaronsb in #521
• feat(docs): add doc catalog librarian tool by @aaronsb in #522
• feat(tls): in-container DNS-01 (porkbun) for letsencrypt mode by @aaronsb in #523
• fix(appliance): make the appliance build + deploy on modern Docker (first cube deploy) by @aaronsb in #524
• fix(appliance): web OAuth client_id/redirect in router overlay (login 400) by @aaronsb in #526
• docs(self-host): remote virt-manager console gotchas (cube) by @aaronsb in #525
• feat(appliance): declarative host-management login (Cockpit/console) by @aaronsb in #527
• feat(appliance): Cockpit behind Traefik at /cockpit (trusted cert) by @aaronsb in #528
• docs(appliance): screenshot placeholders for management surfaces by @aaronsb in #529
• feat(appliance): configurable /cockpit access control + auth hardening by @aaronsb in #530
• feat(appliance): ADR-119 config-delivery model + OVA bootstrap-seed publishing by @aaronsb in #531

Full Changelog: v0.16.0...v0.17.0