Doc review: 5 stalest cards; scale back ai-docs rule; document heph CLI (#373)

## Doc review (5 stalest, all never-reviewed)

Each card was verified against live state (ArgoCD app list/health, manifests, 1Password item fields, Mealie API probe) and stamped `last-reviewed: 2026-06-09`.

| Card | Findings fixed |
|------|----------------|
| `reference/services/argocd.md` | Added Authentik SSO (public PKCE client, `--sso` login, admins→role:admin RBAC); documented dual-cluster management (minikube + ringtail k3s at `ringtail.tail8d86e.ts.net:6443`); corrected sync policy — the `apps` root is **manual**, not automated |
| `reference/services/authentik.md` | Blueprint list grown from 5 to 10 files; OIDC client table now lists all 8 clients with types; secrets table updated to `postgresql-*` fields and per-client secrets |
| `reference/services/grafana.md` | TeslaMate datasource moved to `pg.ops.eblu.me:5434` (ringtail); dashboard inventory refreshed (20 provisioned ConfigMaps); TeslaMate dashboards documented as init-container fetch from forge mirror at pinned tag; SSO role mapping wording corrected (Admin only for `admins` group) |
| `reference/infrastructure/unifi.md` | UnPoller image is now locally built (`registry.ops.eblu.me/blumeops/unpoller`); verified namespace/port |
| `how-to/mealie/plan-a-meal.md` | Procedure verified; **found the stored API token (`op://blumeops/mealie/credential`) returns 401** — operational fix in progress, doc content unchanged |

## AGENTS.md

- **Scaled back the ai-docs rule** (per discussion): agents now start by finding and reading relevant docs; `mise run ai-docs` (~130K tokens now) and `ai-sources` become opt-in bulk loads. `agent-change-process.md` updated to match. The `ai-docs` mise task itself is kept for now — happy to retire it in a follow-up if desired.
- **Documented the heph CLI** task workflow (list/show/context/log read paths; done/drop/skip/log/edit/task write paths) so future sessions can read and manipulate Blumeops tasks without rediscovery.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #373

docs/tutorials/exploring-the-docs.md

@@ -1,6 +1,6 @@
 ---
 title: Exploring the Docs
-modified: 2026-02-10
+modified: 2026-06-09
 tags:
   - tutorials
   - getting-started
@@ -31,7 +31,6 @@ You probably want quick access to operational details:
 - [How-to](/how-to/) guides for common operations (deploy, troubleshoot, update ACLs)
 - [Reference](/reference/) has service URLs, commands, and config locations
 - [[ai-assistance-guide]] explains how to work effectively with AI agents
-- Run `mise run ai-docs` to prime AI context with key documentation
 
 ### For AI Agents
 
@@ -75,13 +74,7 @@ Prek hooks validate that all wiki-links resolve to existing files and flag ambig
 
 ## AI Context Priming
 
-The `ai-docs` mise task concatenates key documentation files for AI context:
-
-```bash
-mise run ai-docs
-```
-
-This outputs key documentation files and a full tree listing of all docs, providing an agent with essential context for BlumeOps operations.
+AI agents prime themselves by searching `docs/` for cards relevant to the task at hand and following wiki-links from there. (The retired `ai-docs` mise task used to concatenate every doc for this purpose, but the corpus outgrew a context window.) For deep codebase questions, `mise run ai-sources` concatenates all non-doc source files.
 
 ## Related