operator-plane: headless smoke + effective-config panel + ledger + unpin ruff

Step 6: tests/smoke_dashboard_headless.py renders the real page in a headless
browser and fails on any JS console/pageerror (standalone script, not
pytest-collected; CI non-blocking first). admin_api gains GET /api/config/effective
(per-key masked value + source: overrides.env vs compose, missing .env.example
keys flagged as drift) + an admin.html table (values XSS-escaped). dashboard.html
gains the Experiment Ledger panel reading the plan-006 verdicts from the snapshot
(empty-state until the tables exist). Removes the last CI ruff per-file pin
(api/main.py:F821) now that os/hmac are imported; scoped ruff is green unpinned.
Marks plan 007 DONE in plans/README.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/docker.yml

@@ -35,15 +35,12 @@ jobs:
         with: { python-version: "3.13" } # match Dockerfile's python:3.13-slim
       - run: pip install -r requirements.txt ruff
       # ruff F gate, scoped to the money path (tests/ and root-level scratch
-      # scripts excluded). Pre-existing errors are pinned per file+rule so NEW
-      # F errors anywhere in scope still fail; remove each pin when its owning
-      # plan lands:
-      #   api/main.py F821 (missing os/hmac imports)          -> plan 007
+      # scripts excluded). All per-file pins have been cleared as their owning
+      # plans landed (api/main.py F821 os/hmac -> plan 007), so this is unpinned.
       - run: >-
           ruff check --select F
           run_live_paper.py trading_execution.py telegram_bot.py
           api/ alpaca_paper/ runtime/ storage/ strategy/ research/
-          --per-file-ignores "api/main.py:F821"
       - run: python -m pytest -q
         env:
           DATABASE_URL: postgresql://momentum:momentum@localhost:5432/momentum