docs(ui): add Stage-0 Web UI spec + ADR-011 (Dex authn, action signal, tapir.d-ma.be GitOps)

Reader + watch/skip/save (instruments the Stage-0 'acts on a summary' metric),
HTMX+Templ over the existing store, Dex OIDC login with single-user allowlist
authz (authn now, tenancy deferred), deployed at tapir.d-ma.be via Flux GitOps
with ESO secrets and in-cluster postgres18. Build decomposed into 4 gated lanes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -219,6 +219,40 @@ path tracked in gitea-mcp #35 (item #1).
 
 ---
 
+## ADR-011 — Web read-surface at Stage 0: Dex authn (single-user authz), action signal, public ingress + GitOps
+
+**Status:** Accepted (2026-06-02)
+
+**Context.** The Stage-0 CLI (`list`/`show`) reads summaries but doesn't capture the Stage-0
+*headline test* — whether the maintainer **acts** on a summary (watches/skips/saves because of
+it). A browser surface is wanted, and the maintainer chose to deploy it properly:
+**`tapir.d-ma.be` via the homelab ingress, full k3s/Flux GitOps**, with **Dex login from the
+start** rather than a Tailscale-only no-auth dev page. The data-model note says "auth is
+dormant at Stage 0", so logging in early is a deliberate deviation worth recording.
+
+**Decision.**
+1. Add a Stage-0 web reader (`tapir serve`, HTMX+Templ) over the existing `store` — a new
+   transport, not a core change (ADR-003). Pages: summary list + full view + **watch/skip/save**
+   actions recorded in a new `summary_actions` table. The action signal instruments the
+   Stage-0 success metric directly.
+2. **Authentication** via Dex OIDC (ADR-002 already names Dex for identity). **Authorization
+   stays trivial**: an allowlist of one subject (the maintainer). NO user CRUD, NO per-tenant
+   isolation — that authz/isolation work is the real Stage-1/2 line and stays deferred. The
+   distinction (authn now, authz/tenancy later) is what keeps this honest with VISION.
+3. **Deploy** at `tapir.d-ma.be` via the existing homelab pattern: gitea CI (buildah) →
+   registry → **Flux** reconciling manifests in `mathias/infra` `k3s/apps/tapir/`; secrets via
+   **ESO + 1Password**; `postgres18` reached in-cluster. This is application of existing
+   convention, not a new infra decision.
+
+**Consequences.** The maintainer gets a real, authenticated reading surface and the Stage-0
+metric becomes queryable. A browser session-login path now exists (distinct from
+`mcp-chassis`'s inbound Bearer-JWT validation — not the same code). Wiring login early adds a
+Dex static-client registration + ingress/TLS as prerequisites. If multiple users ever arrive,
+authorization/isolation is a new ADR (Stage 1) — this one deliberately does not build it.
+Full spec: `docs/ui-spec.md`.
+
+---
+
 ## Rejected alternatives
 
 Approaches considered during the 2026-06-02 planning + grill session and **deliberately not