Add nav/deep link to Temporal Web UI (configurable URL, default 127.0.0.1:8080 for port-forward). Document dual port-forward and draft ACTIVITY-WP-0025 for Keycloak SSO ingress without port-forward.
Add /ops REST inventory, status, runs, and fail-closed operator-token mutations (trigger, enable/disable, pause/unpause) with audit trail. Ship thin HTML UI at /ops/ui, runbook/k8s access docs, and contract tests.