feat: consolidate database management work

Add catalog-owned logical relationships and runtime snapshots, extend the database-management UI and validation coverage, and document the updated operational workflow.

Keep active sensitive-generation status in a tooltip and indicator, and update the layout E2E to follow the history action in its new database-scoped location.

docs/operations/docker-refresh.md

@@ -0,0 +1,43 @@
+# ThothII Docker refresh
+
+The active local `psd-local` stack uses the operator environment generated for the installation:
+
+`deploy/psd/operator.env`
+
+It is not `deploy/thothii.env` (that file is empty) and `deploy/env/local.env` is only an example
+path referenced by the generic launcher. The running stack also uses these Compose overlays:
+
+```text
+compose.yaml
+deploy/compose.local.yaml
+deploy/compose.git-ssh.yaml
+deploy/psd/connector-secrets.yaml
+```
+
+Refresh the stack from the repository root with:
+
+```bash
+compose_psd=(
+  docker compose
+  --env-file deploy/psd/operator.env
+  -p thothii-18998cca7b0a
+  -f compose.yaml
+  -f deploy/compose.local.yaml
+  -f deploy/compose.git-ssh.yaml
+  -f deploy/psd/connector-secrets.yaml
+)
+
+"${compose_psd[@]}" config --quiet
+"${compose_psd[@]}" build core frontend
+"${compose_psd[@]}" stop core frontend
+"${compose_psd[@]}" up -d catalog-db
+"${compose_psd[@]}" run --rm catalog-migrate
+"${compose_psd[@]}" up -d --remove-orphans
+```
+
+Building before the stop keeps the existing application available if an image fails to compile.
+Stopping only `core` and `frontend` prevents the old backend from using a newly migrated catalog;
+the database, Qdrant, embedding service, named volumes, and installation state remain in place.
+
+The installation secret files referenced by that env file live under `deploy/psd/secrets/` and
+must never be committed or printed.