Implement WP-0015-T03: Control Plane reference-rendering routes

New service/reference_docs.py renders specs/policies/*.md and
specs/profiles/*.md read-only at request time via a small markdown
library (added markdown + PyYAML to the service extras) -- not a
static-build pipeline, matching the WP-0012-T03 decision to skip
state-hub's heavier Observable Framework pattern.

One parameterized route, GET /reference/{kind}/{slug}, covers both
addendum URL shapes. Discovered phase_detail.html's Status table never
displayed the degeneration_policy id at all -- added that row (with
the reference link) rather than wiring a link with nothing to attach
it to. phase_new.html gets a plain link next to the field.

Deliberately did not wire extension-id links into the UI in this task
-- extension ids don't appear anywhere in the Control Plane today
(that's WP-0014's gap, not this one's to expand).

6 new Docker-gated tests. Full suite: 94 passing offline, 164 passing
with Docker (up from 158).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_control_plane_app.py

@@ -296,6 +296,64 @@ def test_audit_log_visible_to_signed_in_user(client, credentials):
     assert resp.status_code == 200
 
 
+def test_reference_policy_doc_renders(client, credentials):
+    _login(client, credentials["viewer"].token)
+    resp = client.get("/reference/policies/linear-longstop-v0")
+    assert resp.status_code == 200
+    assert "Linear Longstop v0" in resp.text
+    assert "clamp" in resp.text
+
+
+def test_reference_profile_doc_renders(client, credentials):
+    _login(client, credentials["viewer"].token)
+    resp = client.get("/reference/profiles/development-license")
+    assert resp.status_code == 200
+    assert "Development License" in resp.text
+    assert "Commercial Entitlement" in resp.text
+
+
+def test_reference_unknown_slug_is_404(client, credentials):
+    _login(client, credentials["viewer"].token)
+    resp = client.get("/reference/policies/does-not-exist")
+    assert resp.status_code == 404
+
+
+def test_reference_unknown_kind_is_404(client, credentials):
+    _login(client, credentials["viewer"].token)
+    resp = client.get("/reference/calculators/development-effort-calculator-candidate-a")
+    assert resp.status_code == 404
+
+
+def test_reference_requires_login(client):
+    resp = client.get("/reference/policies/linear-longstop-v0", follow_redirects=False)
+    assert resp.status_code == 303
+    assert resp.headers["location"] == "/login"
+
+
+def test_phase_detail_links_to_policy_reference(client, credentials):
+    _login(client, credentials["operator"].token)
+    phase_id = "trsl:phase:cpapp-refcheck-" + uuid.uuid4().hex[:8]
+    client.post(
+        "/phases/new",
+        data={
+            "phase_id": phase_id,
+            "milestone_release_name": "CP UI reference-link check",
+            "source_revision": "abc123",
+            "repo_hub": "forgejo-coulomb",
+            "repo_hub_uri": "https://forgejo.coulomb.social",
+            "repo_id": "103",
+            "repo_name": "coulomb/target-revenue",
+            "initial_target_amount": "1000",
+            "currency": "USD",
+            "future_license": "MIT",
+            "degeneration_policy": "trsl:policy:linear-longstop-v0@1.0",
+            "longstop_at": "2027-01-01T00:00:00Z",
+        },
+    )
+    detail = client.get(f"/phases/{phase_id}")
+    assert "/reference/policies/linear-longstop-v0" in detail.text
+
+
 def test_form_bridge_script_present(client):
     """whynot-design's wn-input/wn-select/wn-button are not
     form-associated custom elements — their real <input>/<select>/