docs: document operations/+web/ layers and live ci-web.service deployment

CLAUDE.md and docs/ARCHITECTURE.md were still missing the operations/ and web/ packages added by the web-UI plan (W0-W7). Also records that ci-web.service is now live on this host (LAN + Gitea OIDC) in docs/WEB-UI.md and closes plans/web-ui-management-plan.md with a status header.

docs/ARCHITECTURE.md

@@ -239,6 +239,22 @@ src/ci_orchestrator/
 │   ├── ssh.py                 # SSH/SFTP transport via paramiko (replaces ssh.exe/scp.exe)
 │   └── errors.py              # TransportConnectError / TransportCommandError
 │
+├── operations/                 # Pure logic layer, shared by the CLI and the web UI
+│   ├── vms.py                  # list/remove VMs, cleanup orphans, IP-lease reconcile
+│   ├── cache.py                 # cargo cache status/purge
+│   ├── host.py                  # disk status, act_runner status, template backup
+│   └── audit.py                 # append-only JSONL audit log
+│                                 # ZERO click/print — returns frozen dataclasses only;
+│                                 # commands/*.py and web/routes.py both call these.
+│
+├── web/                         # Optional `[web]` extra — FastAPI management dashboard
+│   ├── app.py                   # create_app(config); read-only VM/cache/disk/runner routes
+│   ├── auth.py                  # Gitea OIDC (Authlib) + signed session + fail-closed allowlist
+│   ├── routes.py                # confirm-gated mutating actions (remove/cleanup/purge/backup)
+│   └── security.py              # synchronizer-token CSRF
+│                                 # In-process only: imports operations/ + load_backend directly,
+│                                 # never shells the CLI. See docs/WEB-UI.md.
+│
 └── commands/                  # One module per `click` sub-command group
     ├── wait.py                # `wait-ready`
     ├── vm.py                  # `vm new` / `vm remove` / `vm cleanup`
@@ -246,6 +262,7 @@ src/ci_orchestrator/
     ├── artifacts.py           # `artifacts collect`
     ├── monitor.py             # `monitor disk` / `monitor runner`
     ├── report.py              # `report job`
+    ├── web.py                  # `web serve` — launches the dashboard (lazy fastapi/uvicorn import)
     └── job.py                 # `job` — full end-to-end orchestrator
 ```
 

docs/WEB-UI.md

@@ -12,6 +12,18 @@ config key referenced below.
 
 ---
 
+## 0. Current deployment on this host
+
+Live since 2026-07-23: `ci-web.service` is enabled + running, bound to the
+LAN (`192.168.10.11:8800`), authenticating against `https://gitea.emulab.it`
+via OIDC. Only the allowlisted Gitea user(s) in `/var/lib/ci/config.toml`'s
+`[web].allowed_users` can log in. Manage it exactly as described in §4 below
+(`systemctl status/restart ci-web.service`, `journalctl -u ci-web.service -f`).
+`WebSessionSecret` and `WebOidcClientSecret` are already stored in the
+`ci-runner` keyring — no action needed unless they're rotated (§3/§6).
+
+---
+
 ## 1. Prerequisites
 
 - The Linux host already bootstrapped by `setup-host-linux.sh` (`ci-runner`