Refresh the docs index and reference pages

- docs/README.md: drop the doctor-report.md and audit/ entries (neither
  exists), broaden the ops/ description, list the real subdirectories,
  and stop promising release-by-release migration notes
- migration/v1.3-to-v1.4: note which v1.4 routes have since moved or
  gone; rotation runs via pnpm dlx tsx
- ui-guidelines: six locales with guard tests, settings sections point
  at the registry instead of an eight-item list, /settings redirect is
  a 308
- apple-store-connect-checklist: drop the unsourced 40% rejection-rate
  figure
- codex-protocol-spec: the slug chain rotated on 2026-06-02; default is
  gpt-5.5, the shipped constant is authoritative

docs/migration/v1.3-to-v1.4.md

@@ -7,6 +7,12 @@ new env var in §Environment variables below has a safe default. This
 guide documents what changes for operators and integrators, in case
 you're extending the API or scaling the deployment.
 
+> Historical note: route paths on this page reflect v1.4. Several have
+> since moved or gone: `/api/admin/status-overview` is now
+> `/api/admin/status`, the Umami probe is
+> `/api/admin/monitoring/umami-test`, and the moodLog integration was
+> removed entirely.
+
 ## TL;DR
 
 ```bash
@@ -64,9 +70,10 @@ worker`. Default `all` keeps the single-container behaviour.
 - **`ENCRYPTION_KEY`** _(unchanged)_ — still honoured as a fallback
   when `ENCRYPTION_KEYS` is empty. No action needed for existing
   installs.
-- Rotation: `pnpm tsx scripts/rotate-encryption-key.ts <newKeyId>`
+- Rotation: `pnpm dlx tsx scripts/rotate-encryption-key.ts <newKeyId>`
   re-encrypts every ciphertext under the new key without downtime.
-  Walk-through in `docs/ops/encryption-key-rotation.md`.
+  Walk-through in `docs/ops/encryption-key-rotation.md` (the current
+  playbook; the production image strips `tsx`, hence `pnpm dlx`).
 
 ### Off-host backup target _(optional)_