docs(E): UAT docs + signoff script fixes + pve-ct example (REQ-170)

- docs/uat.md: remove --rp-id from cluster seal (belongs to auth init-idp);
  fix secrets set syntax (positional KEY=value, not --value flag); add
  auth init-idp step; add troubleshooting section (ORCA_HOME, known_hosts,
  Traefik, SSH, job list, Proxmox runtime)
- scripts/uat-signoff.sh: fix 6 assertions (#04 SKIP if no linux, #08
  check node field in JSON, #14 verify file exists first, #27 fix pprof
  grep, #34/35 already passing); add 3 new assertions (#36 traefik
  installed, #37 known_hosts exists, #38 master_key exists); total 38
- examples/full-stack/web-app-lxc.md: pve-ct jobspec variant for Proxmox
  LXC container deployment

---ci---
project: orca
milestone: v0.12.18
phase: E
status: complete
requirements:
  covered: [170]
---/ci---

examples/full-stack/web-app-lxc.md

@@ -0,0 +1,45 @@
+---
+kind: Service
+name: web-app-lxc
+namespace: prod
+
+runtime:
+  one_of: pve-ct
+  image: local:vztmpl/ubuntu-24.04
+
+resources:
+  cpu_millicores: 500
+  memory_mib: 512
+  disk_mib: 2048
+
+ports:
+  - name: http
+    port: 8080
+    protocol: tcp
+
+constraints:
+  - "node.kind == 'proxmox'"
+
+restart:
+  mode: service
+  max_retries: 3
+  delay: 10s
+
+health:
+  interval: 30s
+  timeout: 5s
+  path: /healthz
+
+tasks:
+  - name: web
+    runtime:
+      command: "/bin/bash -c 'apt-get update && apt-get install -y nginx && nginx -g 'daemon off;'"
+    ports:
+      - name: http
+        port: 8080
+        protocol: tcp
+---
+# Web App (LXC container variant)
+# Deploys as a Proxmox LXC container via `pct create`.
+# Requires --target <proxmox-node> and the LXC template
+# (auto-downloaded during `orca node join --type proxmox`).