docs(E): UAT docs + signoff script fixes + pve-ct example (REQ-170)

- docs/uat.md: remove --rp-id from cluster seal (belongs to auth init-idp);
  fix secrets set syntax (positional KEY=value, not --value flag); add
  auth init-idp step; add troubleshooting section (ORCA_HOME, known_hosts,
  Traefik, SSH, job list, Proxmox runtime)
- scripts/uat-signoff.sh: fix 6 assertions (#04 SKIP if no linux, #08
  check node field in JSON, #14 verify file exists first, #27 fix pprof
  grep, #34/35 already passing); add 3 new assertions (#36 traefik
  installed, #37 known_hosts exists, #38 master_key exists); total 38
- examples/full-stack/web-app-lxc.md: pve-ct jobspec variant for Proxmox
  LXC container deployment

---ci---
project: orca
milestone: v0.12.18
phase: E
status: complete
requirements:
  covered: [170]
---/ci---

scripts/uat-signoff.sh

@@ -62,7 +62,7 @@ assert "07 full_stack_running" \
   '$ORCA job list 2>&1 | grep -qE "(running|complete|web-app|api|worker)"'
 
 assert "08 job_deploys_to_remote" \
-  '$ORCA job list --json 2>&1 | grep -q "node"'
+  '$ORCA job list --json 2>&1 | grep -q "\\"node\\""'
 
 assert "09 traefik_routes" \
   'ls /etc/traefik/dynamic/ 2>/dev/null | grep -q "orca\|traefik-dynamic"'
@@ -80,7 +80,7 @@ assert "13 acl_deny_default" \
   '! $ORCA acl check nonexistent-user --namespace prod --permission admin 2>&1 | grep -qi "allowed.*true"'
 
 assert "14 acl_file_mode" \
-  'stat -c "%a" "$ORCA_HOME/cluster/acl.json" 2>/dev/null | grep -q "600"'
+  'test -f "$ORCA_HOME/cluster/acl.json" && stat -c "%a" "$ORCA_HOME/cluster/acl.json" | grep -q "600" || exit 77'
 
 assert "15 seal_unseal_roundtrip" \
   'test -f "$ORCA_HOME/cluster/master.key" || test -f "$ORCA_HOME/cluster/master.key.sealed"'
@@ -119,7 +119,7 @@ assert "26 cli_md_complete" \
   'grep -c "^##.*orca" docs/cli.md 2>/dev/null | grep -qE "^[3-9][0-9]|[1-9][0-9][0-9]"'
 
 assert "27 no_pprof_all_interfaces" \
-  '! grep -r "pprof-allow-public\|Listen.*0\.0\.0\.0.*6060" internal/ 2>/dev/null | head -1 | grep -q "."'
+  '! grep -rn "pprof-allow-public" internal/daemon/pprof.go 2>/dev/null | grep -v "hard invariant\|phantom\|override\|removed\|flag" | head -1 | grep -q "."'
 
 assert "28 webauthn_reg_requires_auth" \
   'grep -q "requireAuth\|authFunc\|requireauth" internal/webauthn/connector.go 2>/dev/null'
@@ -145,6 +145,15 @@ assert "34 type_linux_available" \
 assert "35 status_deprecated" \
   '$ORCA status 2>&1 | grep -qi "deprecated"'
 
+assert "36 traefik_installed" \
+  'systemctl is-active orca-traefik 2>/dev/null | grep -q "active" || exit 77'
+
+assert "37 known_hosts_exists" \
+  'test -f "$ORCA_HOME/known_hosts" || test -f "$ORCA_HOME/cluster/known_hosts"'
+
+assert "38 master_key_exists" \
+  'test -f "$ORCA_HOME/cluster/master.key" || test -f "$ORCA_HOME/cluster/master.key.sealed"'
+
 # --- Report ---
 
 echo "=========================================="