Adds free hosted monitoring workspaces with AT Protocol OAuth, isolated tenant databases, verified HTTPS monitoring, public reports, and operator capacity and usage controls. Public signup initially collects verified interest without allocating a workspace; operators can assign access explicitly.
Includes tenant provisioning and staging-import tools, landing-page and navigation improvements, and removal of unused observation indexes and report changefeed work. Payments and paid upgrades are not included.
Deployment requires control and tenant migrations, Cloudflare bindings, and matching API/coordinator/probe secrets. Hosted deployment defaults to staging and rejects production. The committed runbook records October 2 local OAuth, provisioning, interest-list, and operator-control smoke tests; production-domain smoke checks remain required. Automated tests were not rerun as part of opening this PR.