Add nav/deep link to Temporal Web UI (configurable URL, default 127.0.0.1:8080 for port-forward). Document dual port-forward and draft ACTIVITY-WP-0025 for Keycloak SSO ingress without port-forward.