docs: versioned documentation site, and the four pages that were missing (v0.23.28-beta)

Closes #112.

Source stays `docs/*.md`, rendered by MkDocs-Material and published to GitHub
Pages by Actions. Same repository on purpose: documentation drifts, and
co-location is the only thing that reliably prevents it — the pull request that
changes behaviour changes the description, and review sees both. A separate repo
would double the ceremony and guarantee divergence.

The markdown remains readable when browsing the repository, so the site renders
those files rather than replacing them.

**Versioned from the start**, using mike. Images are published to GHCR and this
project ships betas most days, so readers are routinely running something other
than the newest build; a single "latest" would confidently describe a release
they do not have. Versions follow the product rather than the docs, so the site
and the running image carry the same number.

**Content came first, and it had to.** The docs were eleven days and sixteen
releases stale — SSH keys, bulk commands, the data-cap SMS, poller health and the
timezone setting appeared in exactly zero files between them. Publishing that
would have given documentation missing five of the most consequential features a
polished, authoritative home, and a well-presented wrong answer is worse than an
obviously rough one. Four pages now cover them:

  - cellular.md — signal grading, carrier aggregation, the uplink anchor,
    observed bands, and the data-cap SMS including why it fires early and how to
    calibrate the margin
  - ssh-keys.md — leading with what installing a key costs, because RouterOS
    disables password SSH for that user and the database becomes load-bearing
  - commands.md — why waves exist, and why reading output matters when RouterOS
    reports failure in text rather than an exit code
  - scaling.md — headroom, why it is insufficient on its own, and every tunable

Pull requests build the site with `--strict`, which turns warnings into errors.
That is the point of running it there at all, and it earned itself immediately:
the first build failed on two links to the project README, which sits outside the
docs tree. They are absolute now, so they resolve both in the rendered site and
when reading the markdown on GitHub.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/docs.yml

@@ -0,0 +1,87 @@
+# Documentation site.
+#
+# Two jobs with different jobs to do. On a pull request the site is *built* and
+# nothing is published — a broken link or a page missing from the nav fails the
+# check rather than shipping. On main it is published under a version, because
+# readers are routinely running something other than the newest build and a
+# single "latest" would describe a release they do not have.
+name: Documentation
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'requirements-docs.txt'
+      - '.github/workflows/docs.yml'
+      - 'frontend/package.json'   # version stamp comes from here
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'requirements-docs.txt'
+      - '.github/workflows/docs.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: docs-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build (check only)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+          cache: pip
+      - run: pip install -r requirements-docs.txt
+      # --strict turns warnings into errors, which is the point of running this
+      # on a pull request at all: a link to a page that no longer exists should
+      # fail here rather than 404 for a reader.
+      - run: mkdocs build --strict
+
+  deploy:
+    name: Publish versioned site
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0        # mike needs history to update gh-pages
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+          cache: pip
+      - run: pip install -r requirements-docs.txt
+
+      - name: Derive version from the shipped package
+        id: v
+        run: |
+          # Documentation is versioned with the product, not separately, so the
+          # site and the image a reader is running carry the same number.
+          FULL=$(node -p "require('./frontend/package.json').version")
+          SERIES=$(echo "$FULL" | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
+          echo "full=$FULL"     >> "$GITHUB_OUTPUT"
+          echo "series=$SERIES" >> "$GITHUB_OUTPUT"
+
+      - name: Configure git for mike
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      # Aliased to "latest" so links stay stable while older series remain
+      # readable at their own URLs.
+      - name: Deploy
+        run: |
+          mike deploy --push --update-aliases \
+            "${{ steps.v.outputs.series }}" latest \
+            --title "${{ steps.v.outputs.series }} (${{ steps.v.outputs.full }})"
+          mike set-default --push latest