Add Aether management platform guide and extracted help texts

Aether deployed on oc-node-01, connected to Incus cluster (trust token)
and Operations Center (mutual TLS). Extracted all 16 built-in help pages
(426 KB) covering cluster management, storage, profiles, instances,
HAProxy LB, firewall ACLs, blueprints, and health monitoring.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -34,3 +34,6 @@ env
 
 # Observational deploy output (screenshots, logs)
 observe-runs/
+
+# External software / golden images
+sources/

notes/aether-guide.md

@@ -0,0 +1,223 @@
+# Aether — Management Platform for Incus + OVN
+
+Aether is a web-based management application that connects to Incus clusters
+and Operations Center instances. It provides VM/container deployment via
+blueprints, OVN network management, NSX firewall rule translation to OVN ACLs,
+HAProxy load balancer management, Ansible automation, and RBAC.
+
+## Deployment
+
+### Requirements
+
+- **Image**: Ubuntu Noble (24.04) golden image (~6.6 GiB compressed, 200 GiB
+  virtual disk)
+- **Resources**: 8 GiB RAM minimum
+- **Networking**: needs direct LAN/VLAN access (macvlan recommended)
+- **Services**: PostgreSQL (bundled), FFSDN Go application on port 8443
+
+### Deployment on Incus cluster
+
+```bash
+# Import image
+incus image import sources/aether-golden-image-v6.tar.gz \
+    --alias aether-golden-image-v6 <remote>:
+
+# Create VM (200 GiB disk required — qcow2 virtual size)
+incus init <remote>:aether-golden-image-v6 <remote>:aether --vm \
+    --target <node> --config limits.memory=8GiB -d root,size=200GiB
+
+# Configure macvlan networking for direct VLAN access
+incus config device remove <remote>:aether eth0 2>/dev/null
+incus config device add <remote>:aether eth0 nic nictype=macvlan parent=mgmt
+
+# Start and wait ~30s for boot
+incus start <remote>:aether
+
+# Run post-deploy (configures static IP, regenerates SSH keys, sets up DB)
+incus exec <remote>:aether -- /home/ffsdn/post_deploy.sh <IP/PREFIX> <GATEWAY> <DNS>
+```
+
+### Disk size considerations
+
+The golden image is a qcow2 with 200 GiB virtual size but only ~11 GiB actual
+data. The target node must have at least 200 GiB of allocatable storage (even
+if thin-provisioned). On a fresh IncusOS node with a 64 GiB disk, only ~29 GiB
+is free after the OS. Nodes with 50 GiB disks (~8.5 GiB free) cannot host
+Aether. Target the node with the most available storage.
+
+### Lab deployment details
+
+| Setting | Value |
+|---------|-------|
+| VM name | `aether` |
+| Location | oc-node-01 |
+| IP | 192.168.102.160/22 (VLAN 69) |
+| Gateway | 192.168.100.1 |
+| DNS | 192.168.100.1 |
+| Port | 8443 (HTTPS) |
+| RAM | 8 GiB |
+| Disk | 200 GiB (virtual), ~11 GiB actual |
+
+### Web UI
+
+Access at `https://<IP>:8443`. Default credentials: admin / (set during setup).
+
+### Post-deploy script
+
+`/home/ffsdn/post_deploy.sh` performs 7 steps:
+1. Configure network (netplan)
+2. Apply network configuration
+3. Regenerate SSH host keys
+4. Wait for FFSDN to create PostgreSQL user
+5. Transfer database ownership
+6. Transfer table and sequence ownership
+7. Restart FFSDN service
+
+The script **deletes itself** after successful execution.
+
+## Navigation
+
+The sidebar provides access to all features:
+
+| Menu Item | URL Path | Description |
+|-----------|----------|-------------|
+| Home | `/home` | Dashboard, welcome page |
+| Manage Global FW rules | `/global-acls` | Global firewall / ACL management |
+| Manage Cluster FW rules | (submenu) | Per-cluster firewall rules |
+| Manage RBAC | (submenu) | Role-based access control |
+| Manage VMs/Containers | `/infra` | View and manage instances |
+| Deploy VM/Container/Blueprint | `/deploy` | Launch new workloads |
+| Deployed Blueprints | `/deployedblueprints` | Track blueprint deployments |
+| Blueprint Design | `/blueprintdesign` | Create deployment templates |
+| Ansible Automation | `/awx-endpoints` | Ansible playbook management |
+| Manage INCUS Clusters | `/incus-infra` | Connect and manage Incus clusters |
+| Operations Center | `/operationcenter` | Connect to OC instances |
+| HAProxy Load Balancers | `/haproxy` | Load balancer configuration |
+| Trace Network Flow | `/traceflow` | Network flow analysis (NSX → OVN ACL translation?) |
+| View Live GO Log | `/logs/live` | Real-time application logs |
+| AETHER Ledger | `/logs` | Audit/activity ledger |
+| View Sync Logs | `/synclogs` | Synchronization logs |
+| AETHER Health | `/health` | System health checks |
+| Change Password | `/change-password` | Change admin password |
+| Licensing | `/licensing` | License management |
+| Settings | `/settings` | Application settings |
+
+## Initial Setup
+
+### Step 1: Connect Incus Cluster
+
+Navigate to **Manage INCUS Clusters** (`/incus-infra`) → click
+**Add/Edit/Delete INCUS clusters from/to AETHER**.
+
+The form requires:
+- **Cluster Name**: label for this cluster (e.g., `oc-lab-cluster`)
+- **URL**: Incus API endpoint (e.g., `https://192.168.102.141:8443`)
+- **Trust Token**: generated on the cluster
+
+Generate a trust token on the Incus cluster:
+```bash
+incus config trust add <remote>:AETHER
+```
+
+Paste the token into the form and click **Add Cluster**. The cluster appears
+in the "Current INCUS Clusters" table with its TLS certificate fingerprint
+and expiry date.
+
+After adding, select the cluster from the **Select Cluster** dropdown on
+the INCUS Infrastructure Management page. This loads the cluster dashboard
+with tabs:
+
+| Tab | Description |
+|-----|-------------|
+| Clustering: Members | Cluster nodes with status, memory, load, roles |
+| Clustering: Cluster Groups | Logical groupings of nodes |
+| Storage: Pools | Storage pool configuration |
+| Storage: Volumes | Storage volume management |
+| Profiles | Instance profiles with devices and config |
+| Operations | Running and completed operations |
+| Warnings | Cluster warnings |
+| Settings | Cluster configuration |
+| Images | Cached images across the cluster |
+| Configuration | Cluster-level config keys |
+| Instances | All instances with actions (Start/Stop/Migrate/Console/etc.) |
+| Networking | Networks (bridge, OVN, physical) with View/Edit |
+| ACLs | Network ACL management |
+| Address Sets | Address set management for ACLs |
+| OS | IncusOS node management |
+
+The **Instances** tab provides per-instance action buttons: Start, Restart,
+Freeze, Unfreeze, Stop, Migrate, Snapshot, Console, Logs, Delete. Instances
+can be filtered by type (VM/Container) and status. Each row shows name, type,
+status, IPv4, memory usage, image, snapshots, and location (cluster member).
+
+The **Cluster Members** view shows real-time memory and load bars per node,
+OVN roles, and an Evacuate action button.
+
+### Step 2: Connect Operations Center
+
+Navigate to **Operations Center** (`/operationcenter`) → click
+**+ Add Operations Center**.
+
+The form requires:
+- **Name**: label for this OC (e.g., `oc-lab`)
+- **URL**: OC API endpoint (e.g., `https://192.168.102.120:8443`)
+- **Certificate (PEM)**: client TLS certificate (PEM format)
+- **Private Key (PEM)**: matching private key (PEM format)
+
+Unlike Incus (which uses trust tokens), OC uses **mutual TLS** — Aether
+connects with a client certificate that must already be in the OC trust store.
+Use the same `client.crt` and `client.key` that were injected into the OC
+seed during deployment (typically at `~/.config/incus/client.crt` and
+`~/.config/incus/client.key`).
+
+Click **Test Connection** to verify — a successful test shows:
+`Connected! API: 1.0 (devel)`.
+
+Click **Save** to add the OC. The OC appears in the "Configured Operations
+Centers" table with status, fingerprint, last connected timestamp, and
+Edit/Test/Delete actions. A green **Manage** badge indicates an active
+connection.
+
+### Connection comparison
+
+| | Incus Cluster | Operations Center |
+|---|---|---|
+| Auth method | Trust token | Mutual TLS (client cert + key) |
+| Token/cert source | `incus config trust add` | Existing client cert from `~/.config/incus/` |
+| API version | Incus REST API | OC API 1.0 |
+| Port | 8443 | 8443 |
+
+## Lab State After Setup
+
+### Connected infrastructure
+
+| Connection | Name | URL | Status |
+|------------|------|-----|--------|
+| Incus Cluster | oc-lab-cluster | https://192.168.102.141:8443 | Connected |
+| Operations Center | oc-lab | https://192.168.102.120:8443 | Connected |
+
+### Cluster members (as seen in Aether)
+
+| Node | URL | Status | Memory | Load | Roles |
+|------|-----|--------|--------|------|-------|
+| oc-node-01 | https://192.168.102.140:8443 | Online | 35% (5.5/16.0 GB) | 19% | ovn-chassis, database |
+| oc-node-02 | https://192.168.102.141:8443 | Online | 92% (14.7/16.0 GB) | 28% | ovn-chassis, database-leader |
+| oc-node-03 | https://192.168.102.142:8443 | Online | 54% (8.7/16.0 GB) | 25% | ovn-chassis, database |
+
+### Instances visible in Aether
+
+| Name | Type | Status | IPv4 | Image | Location |
+|------|------|--------|------|-------|----------|
+| aether | VM | Running | 192.168.102.160 | ubuntu noble | oc-node-01 |
+| ovn-central | Container | Running | 10.207.217.23 | Debian bookworm | oc-node-02 |
+| ha-web-02 | Container | Stopped | 10.10.10.3 | Debian bookworm | oc-node-02 |
+| ha-web-03 | Container | Stopped | 10.10.10.4 | Debian bookworm | oc-node-03 |
+
+### Networks visible in Aether
+
+| Name | Type | IPv4 | Uplink | NAT | Used By |
+|------|------|------|--------|-----|---------|
+| UPLINK | physical | 192.168.100.1/22 | - | - | 1 |
+| incusbr0 | bridge | 10.207.217.1/24 | - | IPv4, IPv6 | 2 |
+| meshbr0 | bridge | none | - | IPv6 | 1 |
+| net-prod | ovn | 10.10.10.1/24 | UPLINK | IPv4, IPv6 | 2 |