Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -43,6 +43,7 @@ custom `wp-content` entrypoint).
 
 > 📖 See **[ARCHITECTURE.md](ARCHITECTURE.md)** for detailed system design.
 > 🔼 See [UPGRADE.en.md](UPGRADE.en.md) ([فارسی](UPGRADE.md)) for dependency-upgrade notes.
+> 📋 See [RUNBOOK.en.md](RUNBOOK.en.md) ([فارسی](RUNBOOK.fa.md)) for operations.
 
 ---
 
@@ -298,7 +299,7 @@ Tokens: JWT access (`JWT_EXPIRES_IN`, default 1h) + refresh (7d).
 ## API
 
 All endpoints are prefixed with `/api/v1`. Interactive Swagger docs at
-`http://localhost:4000/docs`. Major route groups: `auth` (OTP request/verify, login,
+`http://localhost:4000/api/docs`. Major route groups: `auth` (OTP request/verify, login,
 refresh), `applications`, `deployments`, `clusters`, `billing` (wallet, invoices,
 transactions, pricing), `snapshots`, `tickets`, `users`, `admin`, `notifications`.