feat(P7): doctor ingress + docs + integration tests (REQ-177,178,179)

New 'orca doctor ingress' command: verifies podman orca-traefik
container running, nft DNAT+SNAT, /etc/traefik/dynamic exists,
step-ca root CA present.

UAT signoff script: replaced assertion 36 (systemd → podman
container), added assertions 40-46 (nft table, DNAT, SNAT, dynamic
dir, step-ca CA, traefik.yml, doctor ingress pass).

docs/ingress.md: R-024 podman traefik section — three topologies,
container config, nft ruleset, doctor ingress, Dockerfile.traefik.
TLS model updated (drop certResolver, tls:{} for v0.14, mTLS v0.15).

ARCHITECTURE.md: v0.14 deltas section — R-024, three topologies,
nft emitter changes, TLS model, migration 0009, new CLI.

Integration tests (tests/ingress_bootstrap_test.go): nft postrouting
+ DNATTarget, priority -10, traefik TLS model (tls:{} no
certResolver), image ref resolution, floating-IP LXC provisioning
commands (pct create with hwaddr/ip/gw/features), MAC generation.

---ci---
project: orca
phase: 7
milestone: v0.14
status: execute
---/ci---

scripts/uat-signoff.sh

@@ -145,8 +145,8 @@ assert "34 type_linux_available" \
 assert "35 status_deprecated" \
   '$ORCA status 2>&1 | grep -qi "deprecated"'
 
-assert "36 traefik_installed" \
-  'systemctl is-active orca-traefik 2>/dev/null | grep -q "active" || exit 77'
+assert "36 traefik_container_running" \
+  'podman inspect --format "{{.State.Running}}" orca-traefik 2>/dev/null | grep -q "true" || exit 77'
 
 assert "37 known_hosts_exists" \
   'test -f "$ORCA_HOME/known_hosts" || test -f "$ORCA_HOME/cluster/known_hosts"'
@@ -154,6 +154,29 @@ assert "37 known_hosts_exists" \
 assert "38 master_key_exists" \
   'test -f "$ORCA_HOME/cluster/master.key" || test -f "$ORCA_HOME/cluster/master.key.sealed"'
 
+# --- v0.14 ingress bootstrap assertions (R-024) ---
+
+assert "40 ingress_nft_table" \
+  'nft list table inet orca-ingress 2>/dev/null | grep -q "chain prerouting"'
+
+assert "41 ingress_nft_dnat" \
+  'nft list table inet orca-ingress 2>/dev/null | grep -q "dnat to"'
+
+assert "42 ingress_nft_snat" \
+  'nft list table inet orca-ingress 2>/dev/null | grep -q "masquerade"'
+
+assert "43 ingress_dynamic_dir" \
+  'test -d /etc/traefik/dynamic'
+
+assert "44 ingress_step_ca" \
+  'test -f /etc/orca/step-ca-root.crt'
+
+assert "45 ingress_traefik_yml" \
+  'test -f /etc/traefik/traefik.yml'
+
+assert "46 ingress_doctor_pass" \
+  '$ORCA doctor ingress 2>&1 | grep -q "PASS"'
+
 # --- Report ---
 
 echo "=========================================="