docs: operations runbook, README verify section, frontend env example

- docs/OPERATIONS.md: deploy flow + rollback, health endpoints, backup/
  restore procedure, audit queries, monitoring stack routine
- README: verification now points at readiness/metrics endpoints and the
  authenticated smoke tests (bare quotes curl is 401 by design)
- frontend/.env.example: observability vars documented

frontend/.env.example

@@ -5,6 +5,13 @@
 VITE_API_BASE_URL=
 
 # Show the "Developer Mode" panel on the login page.
-# true (default) / false — in Docker builds this is controlled by the
-# DEV_LOGIN_ENABLED build arg (see docker-compose.yml), not this file.
-VITE_ENABLE_DEV_LOGIN=true
+# true (default in local dev) / false — in Docker builds this is controlled
+# by the DEV_LOGIN_ENABLED build arg (see docker-compose.yml), not this file.
+VITE_ENABLE_DEV_LOGIN=
+
+# ---- Observability (all optional — empty = disabled, no network calls) ----
+# OpenPanel: browser origin of the self-hosted dashboard/API + project client id.
+VITE_OPENPANEL_URL=
+VITE_OPENPANEL_CLIENT_ID=
+# GlitchTip/Sentry DSN for frontend exception capture.
+VITE_SENTRY_DSN=