Document the target design: the enrichment/triage vision, the
single-LDAP-account SSO access model (Authentik client_credentials for
Grafana, unchanged JWT bearer for gssh, read-only PAT for Gitea), the
headless-auth blocker and its fix in sherlock, the grounded read-only
diagnostic agent, and phased delivery. Index it from the README.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5749c447-6ecd-46bd-946d-21b4d101d084
