docs(E): UAT docs + signoff script fixes + pve-ct example (REQ-170)

- docs/uat.md: remove --rp-id from cluster seal (belongs to auth init-idp);
  fix secrets set syntax (positional KEY=value, not --value flag); add
  auth init-idp step; add troubleshooting section (ORCA_HOME, known_hosts,
  Traefik, SSH, job list, Proxmox runtime)
- scripts/uat-signoff.sh: fix 6 assertions (#04 SKIP if no linux, #08
  check node field in JSON, #14 verify file exists first, #27 fix pprof
  grep, #34/35 already passing); add 3 new assertions (#36 traefik
  installed, #37 known_hosts exists, #38 master_key exists); total 38
- examples/full-stack/web-app-lxc.md: pve-ct jobspec variant for Proxmox
  LXC container deployment

---ci---
project: orca
milestone: v0.12.18
phase: E
status: complete
requirements:
  covered: [170]
---/ci---

docs/uat.md

@@ -184,12 +184,20 @@ orca acl check operator-1 --namespace prod --permission admin
 
 **Expected**: read+write allowed, admin denied (not granted).
 
+### Step 12b: Initialize the OIDC provider (for seal)
+
+```sh
+orca auth init-idp --rp-id orca.local
+```
+
+**Expected**: Dex config + systemd unit + Traefik route rendered. (Dex binary must be installed separately.)
+
 ### Step 13: Seal/unseal
 
 ```sh
-orca cluster seal --rp-id orca.local
+orca cluster seal
 orca cluster unseal
-orca secrets set prod TEST_KEY --value "test-value"
+orca secrets set prod TEST_KEY=test-value
 orca secrets get prod TEST_KEY
 ```
 
@@ -317,3 +325,49 @@ scripts/uat-signoff.sh
 2. Run `scripts/uat-signoff.sh` on the lead
 3. Paste the output back to the CI agent
 4. The CI agent verifies `35/35 PASS` and cuts `v1.0.0`
+
+
+## Troubleshooting
+
+### ORCA_HOME not set
+All orca commands use `$ORCA_HOME` (default `~/.orca`). If commands fail
+with "no such file or directory", verify:
+```sh
+echo $ORCA_HOME
+ls $ORCA_HOME/orca.db $ORCA_HOME/orca_ssh_key $ORCA_HOME/known_hosts $ORCA_HOME/cluster/master.key
+```
+
+### known_hosts missing
+If SSH operations fail with "open .../known_hosts: no such file", the
+known_hosts file was not created during `orca init`. Fix:
+```sh
+touch $ORCA_HOME/known_hosts
+chmod 600 $ORCA_HOME/known_hosts
+```
+
+### Traefik not running
+If Traefik routes are not deployed, verify Traefik is running:
+```sh
+systemctl status orca-traefik
+ls /etc/traefik/dynamic/
+```
+If not installed, `orca init` should have installed it. Re-run `orca init`
+or install manually from https://github.com/traefik/traefik/releases.
+
+### SSH connection refused
+If the orca SSH key is not pre-staged on the remote host:
+```sh
+ssh-copy-id -i ~/.orca/orca_ssh_key.pub root@<host>
+```
+
+### Job deployed but not visible in `job list`
+The remote dispatch path now inserts a DB record (v0.12.16). If you
+still don't see it, check:
+```sh
+orca job list --json
+```
+Look for the `"node"` field — it shows which node the job deployed to.
+
+### Proxmox: process runtime rejected
+Proxmox nodes require `one_of: pve-ct` or `one_of: pve-vm` in the
+jobspec. `one_of: process` (systemd) is for Linux/Ubuntu workers only.