feat(server): add observability and operator controls (#16)

README.md

@@ -91,6 +91,9 @@ Tenant policy, publisher/operator principals, and production key custody are
 defined in [game provisioning and signing-key lifecycle](docs/security/provisioning.md).
 Layered HTTP/UDP budgets, overload behavior, and safe operational tuning are
 defined in [hostile-input and overload protection](docs/security/abuse-protection.md).
+Health semantics, bounded telemetry, alerting, audit privacy, and the authenticated
+operator controls are defined in the
+[observability and operator runbook](docs/operations/observability-and-operator-runbook.md).
 The scriptable host/browser/join diagnostic and its stable automation contract are
 documented in the [TestClient integration guide](docs/integration/test-client.md).
 The always-on three-party scenarios, optional Linux namespace topology, and
@@ -112,7 +115,8 @@ dotnet test Rendezvous.slnx --configuration Release --no-build
 Run the bootstrap server with
 `dotnet run --project src/FinalFactory.Rendezvous.Server`. It serves HTTP health endpoints and binds
 the configured UDP mediator port; both stop through normal host cancellation.
-The launch profile uses an ephemeral development-only signing key. Production
+The launch profile uses separate ephemeral development-only publisher and operator
+signing keys. Production
 startup fails closed until externally supplied game policies and `env:` signing
 key references resolve to valid key material; no reusable game secret is stored
 in this repository or the public Client package.