Implement WP-0015-T03: Control Plane reference-rendering routes

New service/reference_docs.py renders specs/policies/*.md and
specs/profiles/*.md read-only at request time via a small markdown
library (added markdown + PyYAML to the service extras) -- not a
static-build pipeline, matching the WP-0012-T03 decision to skip
state-hub's heavier Observable Framework pattern.

One parameterized route, GET /reference/{kind}/{slug}, covers both
addendum URL shapes. Discovered phase_detail.html's Status table never
displayed the degeneration_policy id at all -- added that row (with
the reference link) rather than wiring a link with nothing to attach
it to. phase_new.html gets a plain link next to the field.

Deliberately did not wire extension-id links into the UI in this task
-- extension ids don't appear anywhere in the Control Plane today
(that's WP-0014's gap, not this one's to expand).

6 new Docker-gated tests. Full suite: 94 passing offline, 164 passing
with Docker (up from 158).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/target_revenue/service/control_plane_app.py

@@ -26,7 +26,7 @@ from psycopg_pool import ConnectionPool
 from starlette.middleware.sessions import SessionMiddleware
 
 from .. import control_plane, ledger, metrics, registry
-from . import keys
+from . import keys, reference_docs
 
 _STATIC_DIR = os.path.join(os.path.dirname(__file__), "static")
 _TEMPLATES_DIR = os.path.join(os.path.dirname(__file__), "control_plane_templates")
@@ -37,6 +37,8 @@ _SECRET_KEY_ENV = "TRF_CONTROL_PLANE_SECRET_KEY"
 app = FastAPI(title="Target Revenue Control Plane", version="0.1.0")
 app.mount("/static", StaticFiles(directory=_STATIC_DIR), name="static")
 templates = Jinja2Templates(directory=_TEMPLATES_DIR)
+templates.env.globals["policy_slug"] = reference_docs.policy_slug_from_id
+templates.env.globals["extension_slug"] = reference_docs.extension_slug_from_id
 
 _secret_key = os.environ.get(_SECRET_KEY_ENV)
 if not _secret_key:
@@ -408,3 +410,31 @@ def audit_log(
 ):
     log = control_plane.get_audit_log(conn)
     return templates.TemplateResponse(request, "audit.html", _template_context(request, licensor, log=log))
+
+
+# --- Reference docs (specs/policies/, specs/profiles/) ----------------------
+
+
+@app.get("/reference/{kind}/{slug}")
+def reference_doc(
+    kind: str,
+    slug: str,
+    request: Request,
+    licensor: registry.Licensor = Depends(require_login),
+):
+    """Read-only rendering of a `specs/policies/`/`specs/profiles/`
+    markdown file (WP-0015-T03) — never editable from here."""
+    result = reference_docs.load_reference_doc(kind, slug)
+    if result is None:
+        raise HTTPException(status_code=404, detail="reference document not found")
+    doc_html, frontmatter = result
+    return templates.TemplateResponse(
+        request,
+        "reference.html",
+        _template_context(
+            request, licensor,
+            doc_html=doc_html,
+            doc_title=frontmatter.get("title", slug),
+            source_path=f"specs/{kind}/{slug}.md",
+        ),
+    )