feat: add public h5 dashboard and publish traceability

.project-docs/20-architecture/system-overview.md

@@ -31,7 +31,9 @@ from committed `ARRIVAL` facts, publishes a validated workbook, and records meta
 ## Important Boundaries
 
 - The uploaded source is re-materialized from committed object storage before processing.
-- Login documents/assets, `POST /api/login` and minimal `/healthz` readiness are the only anonymous Web routes. Portal documents redirect to login; business APIs, detailed health, uploads, traces and downloads return `401` without an authenticated server-side session.
+- Login documents/assets, the H5 read-only page/assets, purpose-built public H5 aggregate endpoints, `POST /api/login`
+  and minimal `/healthz` readiness are anonymous Web routes. The desktop portal redirects to login; generic business
+  APIs, detailed health, uploads, traces and downloads return `401` without an authenticated server-side session.
 - Operator credentials come only from runtime `ARR_WEB_USERNAME` / `ARR_WEB_PASSWORD`; the application fails closed when either is absent. Authenticated mutations also require the per-session CSRF token.
 - Processor exit code and JSON status must agree; output paths are confined to an isolated temporary directory.
 - Validation completes before the database transaction; any transaction failure leaves no partial active version.