Add a public API wiki at /wiki

Builds docs/ into a static site via mkdocs + mkdocs-material in its own
Docker build stage (docs-builder), so mkdocs itself never ends up in the
runtime image -- only the rendered HTML does, mounted at /wiki alongside
the existing /docs OpenAPI schema (unconditionally, unlike /docs, since
this is curated content meant to be public regardless of
AURORA_API_DOCS_ENABLED).

docs/aurora-core-spec.md (the internal build spec, referenced by "section
N" comments throughout the codebase) is excluded from the built site
entirely via exclude_docs, not just left out of the nav -- it was never
meant for public consumption.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

docker/api.Dockerfile

@@ -23,6 +23,15 @@ COPY app ./app
 # import string against the CWD regardless.
 RUN pip install --no-cache-dir -e .
 
+# Builds the /wiki static site (mkdocs) in its own stage so mkdocs and its
+# dependencies never end up in the runtime image -- only the rendered HTML
+# does, copied in below.
+FROM base AS docs-builder
+RUN pip install --no-cache-dir mkdocs mkdocs-material
+COPY mkdocs.yml ./
+COPY docs ./docs
+RUN mkdocs build --strict -d /wiki_site
+
 FROM base AS runtime
 RUN useradd --create-home --uid 1000 aurora
 COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
@@ -30,6 +39,7 @@ COPY --from=builder /usr/local/bin /usr/local/bin
 COPY app ./app
 COPY migrations ./migrations
 COPY alembic.ini ./alembic.ini
+COPY --from=docs-builder /wiki_site ./wiki
 # Owned by aurora *before* the volume mount happens — see worker.Dockerfile
 # for why (a fresh named volume otherwise defaults to root-owned, which the
 # non-root `aurora` user below can't write into).