Adds Monitoring Setup docs and deploy-scp troubleshooting/debug fixes

Monitoring Setup: operations/plans/monitoring-setup-plan.md and
operations/monitoring/monitoring-instructions.md, covering Sentry alert
rules on the security_event tag, UptimeRobot's 6 liveness monitors, and
the two new Umami website entries for the admin SPA.

deployment-instructions.md gains a missing Observability__Environment
host var (without it, both environments would tag Sentry events as
"Production"), the nginx client_max_body_size fix for the 413 seen on
publish-test/production artifact uploads, and two troubleshooting notes
on Gitea Actions re-run behaviour: re-running deploy-test/production
alone loses the run's uploaded artifact, and re-running all jobs on an
existing (rather than a brand new) run can replay stale secrets.

deploy-scp.yaml: step names no longer show literal unresolved
${{ inputs.* }} text (Gitea doesn't interpolate that context in step
names), and a temporary debug step logs PI_MAIN_USERNAME/PASSWORD
length plus a username equality check to diagnose a persistent
Permission denied during the SSH steps, without ever logging the
secret values themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015FffvxxJp5wG34Ru48GBig

aidlc-docs/features/gitea-deployment-workflow/aidlc-state.md

@@ -179,8 +179,15 @@ Execution rounds (Q4 = B): **R1** = U1 + U2 · **R2** = U3 + U4 · **R3** = U5 +
 - [x] Build and Test — **EXECUTE** — Complete 2026-07-28. 609 unit tests (372 backend + 237 frontend), 0 vulnerable packages, 0 build errors. Plus live-host integration verification: static content/SPA-fallback/header-scoping, real master↔slave communication proving the persistent key ring survives a process restart, and W3C trace-id correlation in real log output. Artifacts in `construction/build-and-test/`
 
 ### OPERATIONS
-- [ ] Deployment Setup — **EXECUTE**
-- [ ] Monitoring Setup — **EXECUTE**
+- [x] Deployment Setup — **EXECUTE** — Complete 2026-07-28, extended 2026-07-29 (MariaDB migration,
+  reverse proxy topology correction, artifact-upload 413 fix in `deployment-instructions.md` § 1.7.3,
+  missing `Observability__Environment` host var added § 1.5). Artifacts: `operations/deployment/`
+- [x] Monitoring Setup — **EXECUTE** — Complete 2026-07-29. Plan answered (Sentry project reused,
+  UptimeRobot account reused, Umami website entries created by user, 20-events/5-min default alert
+  threshold). User has applied the real values in Gitea variables, UptimeRobot and Sentry directly
+  (DSN, Umami website IDs, alert rules, 6 monitors) — not verified by execution from this session
+  (no access to those external accounts), taken on the user's report. Artifacts:
+  `operations/plans/monitoring-setup-plan.md`, `operations/monitoring/monitoring-instructions.md`
 - [ ] Production Readiness Validation — **EXECUTE** (includes the `dotnet-appsettings` compliance gate)
 
 ## Execution Plan Summary
@@ -190,9 +197,13 @@ Execution rounds (Q4 = B): **R1** = U1 + U2 · **R2** = U3 + U4 · **R3** = U5 +
 
 ## Current Status
 - **Lifecycle Phase**: OPERATIONS
-- **Current Stage**: Build and Test **complete** 2026-07-28 (all 7 units, full-suite + live-host integration verification). CONSTRUCTION phase is now closed
-- **Next Stage**: Deployment Setup (Operations Configuration = Yes, decided at Requirements Analysis)
-- **Status**: Rounds 1–4 all done, nothing pushed. Entering Operations phase
+- **Current Stage**: Deployment Setup complete (2026-07-28, extended 2026-07-29). Monitoring Setup
+  complete 2026-07-29 — user applied real values in Gitea, UptimeRobot and Sentry
+- **Next Stage**: Production Readiness Validation (includes the `dotnet-appsettings` compliance gate)
+- **Status**: CI pipeline built and merging via an open PR; `workflow_dispatch` manual testing of
+  `deploy-test`/`deploy-production` (and therefore a real end-to-end run touching the monitors/alerts
+  just configured) blocked until that PR merges to `master` (Gitea Actions only shows manual-dispatch
+  workflows that exist on the default branch)
 
 ## Round 2 Design Record (2026-07-28)
 - Functional Design U3 + U4 complete and committed (`357d395`)