feat: current state

docs/operations.md

@@ -0,0 +1,26 @@
+# Operations
+
+## Prerequisites
+
+Install Azure CLI and authenticate to the desired tenant before launching the
+TUI. The application reads the tenant from `az account show`, filters
+subscriptions to that tenant and to the `Enabled` state, and explicitly passes
+each subscription to Azure CLI. It never runs `az account set`.
+
+Network routing, DNS, private-endpoint connectivity and firewall access remain
+environmental prerequisites. A discovered server may still reject a PostgreSQL
+connection.
+
+## Profiles
+
+Profiles live in the platform application configuration directory as
+`profiles.json`. The file contains no password. On macOS and Windows the TUI
+can reference a system-keychain secret; otherwise a password is session-only.
+An unsupported future profile-file format is rejected without overwriting it.
+
+## Dependency lock
+
+`Cargo.lock` is part of the source of truth. Use locked Cargo commands. If the
+manifest changes, regenerate the lockfile through the controlled maintainer
+dependency-resolution process before running CI or release jobs. CI does not
+repair or regenerate a lockfile.