[minor] Document the portable LibOps architecture

.github/workflows/docs-check.yml

@@ -0,0 +1,32 @@
+name: docs-check
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-check-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out documentation
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: "22.23.1"
+
+      - name: Validate documentation and links
+        run: make docs-check

Makefile

@@ -0,0 +1,7 @@
+.PHONY: docs-check
+
+MINT_VERSION ?= 4.2.687
+
+docs-check:
+	npx --yes mint@$(MINT_VERSION) validate
+	npx --yes mint@$(MINT_VERSION) broken-links --check-anchors --check-redirects --check-snippets

cli/api-keys.mdx

@@ -1,38 +1,8 @@
 ---
-title: 'API Keys'
-description: 'Create, list, save, and revoke LibOps API keys'
+title: 'LibOps API keys in sitectl'
+description: 'Find the maintained LibOps authentication reference'
 ---
 
-API keys provide sustained access after an OAuth login. The CLI checks `~/.sitectl/key` before using OAuth tokens.
+This legacy route is retained for existing links. Current API-key creation, storage, scopes, and revocation behavior is documented in the [sitectl LibOps authentication reference](https://sitectl.libops.io/plugins/libops/authentication).
 
-## Create
-
-```bash
-sitectl libops create apikey --name workstation --save
-sitectl libops create apikey \
-  --name ci-deploy \
-  --description "GitHub Actions deploy key" \
-  --scopes organization:read,project:write,site:write
-```
-
-`--save` stores the returned secret in `~/.sitectl/key`.
-
-<Warning>
-The API key secret is only shown once. Save it immediately or create a replacement key.
-</Warning>
-
-## List
-
-```bash
-sitectl libops list apikeys
-sitectl libops list apikeys --format json
-```
-
-## Revoke
-
-```bash
-sitectl libops delete apikey "$API_KEY_ID"
-sitectl libops delete apikey "$API_KEY_ID" --yes
-```
-
-Use scopes in `resource:level` form, for example `organization:read`, `project:write`, or `site:admin`.
+For API integration boundaries, see [API and sitectl](/platform/api-cli).

cli/authentication.mdx

@@ -1,76 +1,8 @@
 ---
-title: 'Authentication'
-description: 'Log in to LibOps from the terminal and manage sustained CLI access'
+title: 'sitectl authentication'
+description: 'Find the maintained LibOps plugin authentication reference'
 ---
 
-LibOps CLI commands are exposed by the `sitectl-libops` plugin. When installed through `sitectl`, run them under the `libops` namespace:
+This legacy route is retained for existing links. Current login, account, API-key, and SSH-key behavior is documented in the [sitectl LibOps authentication reference](https://sitectl.libops.io/plugins/libops/authentication).
 
-```bash
-sitectl libops login
-sitectl libops whoami
-sitectl libops logout
-```
-
-If you are running the plugin binary directly, use the same command names without the `sitectl libops` prefix.
-
-## Browser login
-
-`login` opens the same dashboard login screen used by the web UI, including **Login with Google**. The CLI starts a temporary localhost callback server, receives the OAuth result, and stores the OAuth token in `~/.sitectl/oauth.json`.
-
-```bash
-sitectl libops login
-sitectl libops login --api-url https://api.libops.io
-sitectl libops login --timeout 10m
-```
-
-After login, the CLI offers to create an API key and save it to `~/.sitectl/key` for sustained access.
-
-## whoami
-
-Use `whoami` to inspect the active identity and development access readiness:
-
-```bash
-sitectl libops whoami
-```
-
-The command reports OAuth/API-key state, account ID, email, GitHub username, LibOps SSH key count, and whether you still need to update your development config. For checkout and SSH workflows, your GitHub username must be set and the same SSH public key must be added to both GitHub and LibOps.
-
-Update your account profile from the CLI:
-
-```bash
-sitectl libops account update --github-username octocat
-sitectl libops account update --name "Ada Lovelace"
-```
-
-## API keys
-
-Create API keys for non-interactive access:
-
-```bash
-sitectl libops create apikey --name workstation --save
-sitectl libops create apikey --name ci --scopes organization:read,project:write
-sitectl libops list apikeys
-sitectl libops delete apikey "$API_KEY_ID" --yes
-```
-
-If a saved API key exists, LibOps commands use it before falling back to OAuth credentials.
-
-## SSH keys
-
-LibOps SSH access is account-scoped:
-
-```bash
-sitectl libops create ssh-key --name laptop --public-key-file ~/.ssh/id_ed25519.pub
-sitectl libops list ssh-keys
-sitectl libops delete ssh-key "$KEY_ID" --yes
-```
-
-The same public key must also be added to GitHub for repository checkout over SSH.
-
-## Logout
-
-```bash
-sitectl libops logout
-```
-
-`logout` removes both `~/.sitectl/oauth.json` and `~/.sitectl/key`.
+For the platform security boundary, see [Security and Operations](/platform/security-operations).