Cockpit: full manual QA, security review, and non-Docker deployment docs

[smota]

Background & Problem Statement

Epic: #125

Cockpit needs complete validation and documentation for local and remote non-Docker use before broader rollout. Docker is intentionally second pass.

Proposed Solution

Create manual QA scripts, security review checklist, OAuth setup guide, reverse-proxy/TLS notes without Docker packaging, troubleshooting, and release readiness checklist.

Requirements

• Manual QA: goal board, issue view, replay, markdown export, OAuth login/logout, guarded actions disabled/enabled.
• Security checklist for OAuth, sessions, CSRF, headers, rate limits, audit logs.
• Non-Docker deployment docs: Node service, process manager, TLS reverse proxy, env config.
• Privacy checklist: no raw transcripts, prompts, tool inputs, secrets, or full logs.
• Rollback/disable guide.

Acceptance criteria

• Manual QA script exists and is runnable.
• Security review checklist exists.
• GitHub OAuth setup guide complete.
• Non-Docker remote deployment guide complete.
• Release checklist marks Docker as future pass.

Test plan

• Docs review.
• Manual QA execution evidence.
• Security checklist walkthrough.

Workflow classification

Validation/docs issue. Requires human security/acceptance review before release.

[github-actions]

Integrated into development by PR #133: #133

Merge commit: 823d2e784f61e11645d2902e35401134fe0b1bdc
Release/promotion to main is tracked separately.