Make dev docs reachable publicly

## Original requirement (verbatim, epic body) > When creating a cron, allo user to pick a different type of target. Currently the target is a project. Other types: node, none (just run a task without a project - we have that impelemented), what else? > > When node is a target it runs a task on all selected nodes. > > Implement a nice target selector, that allows to quickly add all, remove all, do all except specific, etc. It has to be a very compact and robust control. It must work for both projects, nodes and other targets. > > Make sure this is naturally working and improves previous work - triggers, crons, etc. All of these things (triggers, webhooks, crons, etc.) are combined into a unified coherent system that is state of the art and uses best practices (do a web research). Epic chain (this breakdown): C2 Node targets API -> C1 Automation core API -> C3 Fire engine API; C4 TargetSelector web; C5 TaskSpecFields web; then C6 Automations UI alongside C8 dev docs reach infra (this child); then C7 reader docs (needs C6, C8). ## This child: C8 Dev docs reach (infra) Operator answer O5 ("Fix the root cause"): the AC6.2 docs oracle ("open the docs portal on dev and observe the new pages plus working redirects") cannot reach `docs.dev.jaah.ai` from runner nodes because dev sets `docs_on_public_alb = false` (default, `infra/jaah/terraform/variables.tf:379-387`), so the dev docs name aliases the **internal** ALB (`infra/jaah/terraform/modules/ecs/aliases.tf:37-39`). Owns O5. Acceptance carried verbatim from the architecture (C8 acceptance): after the dev deploy applies, `curl https://docs.dev.jaah.ai/` from runner node h2 returns 200, the page carries `noindex`, and the terraform plan in the deploy log shows only the docs ALIAS record and the listener rule moving to the public-UI ALB, with **no security-group change**. That proves the docs name inherits the admin-prefix-list restriction (`public-ui.tf:52-74`) rather than opening to the internet. ### How - Set `docs_on_public_alb = true` in `infra/jaah/terraform/environments/dev/dev.jaah.tfvars`. `DOCS_NOINDEX=1` stays. The docs name then rides dev's internet-facing public-UI ALB, which on dev admits **only the admin prefix list** (`modules/ecs/public-ui.tf:3, 27`) - the same reach `app.dev.jaah.ai` has. - Update the text that calls dev docs "tailnet-only": the variable description / terraform README, and the lines in `docs/architecture.md` and `apps/docs/README.md` that say so (single-home: keep the fact in one place and point to it). - `terraform fmt -recursive && terraform validate` before commit. Never `-auto-approve` by hand; the apply rides the deploy workflow (`jaah-deploy.yml:136-142` maps a push to develop to env dev with action=apply; its terraform step is plan-file-gated, `:650-670`). Never paste `state show` output anywhere. Credentials & reach: GitHub Actions `jaah-deploy.yml`, read with `jaah-forge` under your own forge login - **verified** (from h2, `jaah-forge api get repos/jaah-ai/jaah/actions/workflows/jaah-deploy.yml/runs?branch=develop` returned develop runs). `https://docs.dev.jaah.ai` - unreachable from h2 today (this child fixes it); `https://app.dev.jaah.ai/docs/*` answers 301 to that host (probed). Out of scope: Do NOT change any security group, prefix list, prod tfvars, or the public-UI ALB's admission rules. Do NOT remove DOCS_NOINDEX. Do NOT touch application code or reader-doc content (C7). Epic out of scope: no feature flag; nothing else from the Automations epic is built here. Done means: - `terraform fmt -check -recursive` and `terraform validate` clean - oracle: command output in your report. - The Jaah Deploy run for your merge commit on develop succeeds, and its terraform plan log shows only the docs ALIAS record and the listener rule moving to the public-UI ALB, with no security-group change - oracle: the plan excerpt from the run log (via `jaah-forge`) quoted in your report. - `curl -sS -o /dev/null -w '%{http_code}' https://docs.dev.jaah.ai/` from this runner node returns 200 and the page carries `noindex` - oracle: the curl output in your report. - No remaining doc line calls dev docs tailnet-only - oracle: a grep in your report. - `./dc check full` green; PR merged to develop.

Dev docs moved to the public-UI ALB (admin prefix list only, no SG change). PR #4944 merged, Jaah Deploy green; docs.dev.jaah.ai now returns 200 with noindex from this runner. Tailnet-only doc lines updated.