Add nav/deep link to Temporal Web UI (configurable URL, default 127.0.0.1:8080 for port-forward). Document dual port-forward and draft ACTIVITY-WP-0025 for Keycloak SSO ingress without port-forward.
Expose last_run_at / last_run on the status contract and display Last run and Tasks columns on the /ops/ui status page for the selected window.
Add /ops REST inventory, status, runs, and fail-closed operator-token mutations (trigger, enable/disable, pause/unpause) with audit trail. Ship thin HTML UI at /ops/ui, runbook/k8s access docs, and contract tests.