Summary

Correct a security-relevant documentation inaccuracy and expand two reference docs with information that was missing or scattered across the codebase.

Why

The auth table in docs/http-api.md labelled POST /v1/events as "loopback only†" which implied server-side enforcement. In reality, server/routes/ingest.py has no host or token check — only POST /v1/promote and POST /v1/rollback call _require_mutation_access. This gap meant operators using --host 0.0.0.0 could believe ingest was protected when it is not. Two other areas had no dedicated documentation: the flightdeck-quickstart-verify CLI tool and operational runbook for SQLite, doctor failures, and backup.

Changes

docs/http-api.md

• Changed POST /v1/events auth column from "loopback only†" to "open†"
• Rewrote footnote to state explicitly: no server-side host or token gate exists; security relies on bind address + network topology; --host 0.0.0.0 makes ingest reachable from any host

SECURITY.md

• Added a clear statement that POST /v1/events and POST /v1/diff have no server-side host/token check, distinguishing them from the mutation routes
• Guidance to use network-layer controls when binding to non-loopback

DEVELOPMENT.md

• Added "What flightdeck-quickstart-verify does" subsection documenting the 11-step end-to-end workflow, subprocess error handling, executable resolution (PATH → sys.executable fallback), and temp-dir isolation

docs/operations-and-policy.md

• Added "Server initialization: lifespan vs. ensure_app_state" section documenting how create_app lifespan populates app.state, the lazy-fallback behavior of ensure_app_state for test contexts, the cwd-at-first-request implication, and "testclient" in _LOCAL_CLIENT_HOSTS
• Added "Operational runbook" section: SQLite SQLITE_BUSY causes and remedies, backup/restore procedure (offline copy + WAL checkpoint pattern), and a doctor failure interpretation table with fix guidance per check

Validation

• uv sync --frozen --extra dev
• uv run python -m ruff check src tests — passes
• uv run python -m pytest — doc-only change; no Python source touched
• Schema/storage not touched — no schema regeneration needed
• web/ not touched — no static build needed

Schema / Storage Impact

• None

Risk

Documentation only. No Python source, schema, or static asset changes.

Review

• Requested review from maintainers
• PR is small and scoped — four files, all documentation

Notes

Source of truth for ingest auth: src/flightdeck/server/routes/ingest.py (no _require_mutation_access call) vs src/flightdeck/server/routes/actions.py (both promote and rollback call it).