docs: add USER_GUIDE.md, tighten comments, fix CLI needing a DSN

The comment pass is prose-only: every distinct "why" is kept, the
narration around it is not. Verified by AST-comparing each changed file
against HEAD with docstrings stripped — only the two files below differ
in executable code.

Two real fixes fell out of the read-through:

* The CLI documented itself as never touching the database, then called
  load_settings(), which requires SVCFORGE_PG_DSN. It refused to start
  without a Postgres URL it never opens. It now has its own two-field
  ClientSettings; the orphaned api_url/api_token are dropped from
  Settings, where nothing else read them.
* repo/db.py had the DictRow alias comment and the ERROR_MAX_CHARS
  comment run together above the wrong symbol.

USER_GUIDE.md is the caller-facing guide the README only gestured at:
auth, catalog, every endpoint with curl, the lifecycle, the error table,
rate limiting, the CLI, client generation, an end-to-end poll loop.

It records two facts about the live deployment rather than documenting a
flow nobody can run. SVCFORGE_JWKS_URL points at a realm with no IdP
behind it, so the API logs "JWKS warm-up failed" at startup and every
/v1 request is a 401. And `helm repo list` in the worker returns no
repositories, so the three bitnamilegacy/ catalog entries cannot resolve
at provision time; only the oci:// entries can.

make lint clean, 76 unit + 111 integration tests pass.

services/api/deps.py

@@ -1,8 +1,8 @@
 """Dependency injection: how a handler gets a pool, a repo, a catalog, and a team.
 
 Everything expensive — the pool, the JWKS client, the parsed catalog — is built once in
-`lifespan` and parked on `app.state`. These functions only hand it out. A `Depends` that
-does I/O per request is a `Depends` that does that I/O on every request forever.
+`lifespan` and parked on `app.state`; these functions only hand it out. A `Depends` that
+does I/O per request does that I/O on every request forever.
 """
 
 from __future__ import annotations
@@ -22,10 +22,9 @@ from svcforge_core.repo.instances import InstanceRepo
 from svcforge_core.repo.tasks import TaskRepo
 from svcforge_core.settings import Settings
 
-# The algorithm allow-list is the whole point of naming algorithms explicitly.
-# `jwt.decode(..., algorithms=...)` without it accepts whatever the *token* claims in its
-# own header — including `none`, and including HS256 verified with the RSA public key as
-# an HMAC secret. Both are forgery. The list is not configuration.
+# The algorithm allow-list is not configuration. Without it, `jwt.decode` accepts whatever
+# the *token* claims in its own header — including `none`, and including HS256 verified
+# with the RSA public key as an HMAC secret. Both are forgery.
 ALLOWED_ALGORITHMS = ["RS256"]
 
 # What `auth_disabled` returns. Settings.check_production() refuses that flag in prod.
@@ -42,9 +41,9 @@ _bearer = HTTPBearer(auto_error=False)
 def _unauthorized() -> HTTPException:
     """One shape for every auth failure.
 
-    Expired, wrong issuer, wrong audience, bad signature, malformed, no header: all the
-    same 401 with the same body. Telling a caller *which* one turns the endpoint into an
-    oracle they can tune a forgery against.
+    Expired, wrong issuer, wrong audience, bad signature, malformed, no header: the same 401
+    with the same body. Naming which one turns the endpoint into an oracle a forger can tune
+    against.
     """
     return HTTPException(
         status_code=status.HTTP_401_UNAUTHORIZED,
@@ -68,8 +67,8 @@ async def get_pool(request: Request) -> DictPool:
 def get_catalog(request: Request) -> dict[str, CatalogEntry]:
     """The catalog, parsed once at startup.
 
-    Read from disk per request and a mid-flight edit to catalog.yaml changes the answer
-    between two requests of the same deploy. Load it at startup; a change is a restart.
+    Read per request, a mid-flight edit to catalog.yaml would change the answer between two
+    requests of the same deploy. A catalog change is a restart.
     """
     catalog: dict[str, CatalogEntry] = request.app.state.catalog
     return catalog
@@ -102,16 +101,14 @@ async def get_current_team(
 
     jwks_client: PyJWKClient | None = getattr(request.app.state, "jwks_client", None)
     if jwks_client is None:
-        # Auth is on but there is no key source. Fail closed. Answering 500 here would be
-        # honest about the cause and would also let a misconfigured deploy be told apart
-        # from a bad token; 401 is the same answer a forger gets.
+        # Auth is on but there is no key source. Fail closed. A 500 would be honest about
+        # the cause and would also let a forger tell a misconfigured deploy from a bad token.
         raise _unauthorized()
 
     try:
-        # PyJWKClient keeps its own TTL cache, so this is a dict lookup on the hot path.
-        # It is only blocking on a cache MISS (key rotation) — hence to_thread, which
-        # costs a thread hop we take a handful of times a day rather than an event loop
-        # stalled on someone else's HTTP call once per rotation.
+        # PyJWKClient keeps a TTL cache, so this is a dict lookup on the hot path and only
+        # blocks on a miss (key rotation) — hence to_thread, a thread hop a few times a day
+        # rather than an event loop stalled on someone else's HTTP call.
         signing_key = await _signing_key(jwks_client, creds.credentials)
         claims: dict[str, Any] = jwt.decode(
             creds.credentials,
@@ -139,10 +136,9 @@ async def get_current_team(
 async def _signing_key(client: PyJWKClient, token: str) -> jwt.PyJWK:
     """Fetch the signing key off the event loop.
 
-    PyJWKClient.get_signing_key_from_jwt() does a synchronous urlopen on a cache miss.
-    Called directly from `async def`, that blocks the loop — every other in-flight request
-    on this worker stops until the identity provider answers, and if it hangs, so does the
-    pod, and /readyz keeps saying it is fine.
+    `get_signing_key_from_jwt()` does a synchronous urlopen on a cache miss. Called directly
+    from `async def` it blocks the loop: every other in-flight request stops until the IdP
+    answers, and if the IdP hangs so does the pod, with /readyz still saying it is fine.
     """
     return await asyncio.to_thread(client.get_signing_key_from_jwt, token)
 
@@ -159,11 +155,10 @@ async def rate_limit(
 ) -> None:
     """Per-team rate limiting. One Redis command per check, and it fails OPEN.
 
-    Failing open is the entire policy. Redis holds derived state; losing it must degrade
-    the platform, never stop it. A limiter that fails closed converts a cache outage into
-    a total outage, which is a strictly worse incident than the burst it was protecting
-    against — so `RateLimiter.check` swallows its own errors and returns `allowed=True`.
-    The 429 below therefore only ever comes from a real, counted overage.
+    Redis holds derived state, so losing it must degrade the platform rather than stop it: a
+    limiter that fails closed turns a cache outage into a total outage, a worse incident
+    than the burst it was guarding against. `RateLimiter.check` swallows its own errors and
+    returns `allowed=True`, so the 429 below only comes from a real, counted overage.
     """
     limiter = get_rate_limiter(request)
     if limiter is None: