Topology And Trust Administration

Purpose

Make Setup > Topology and Setup > Trust & Signing the canonical owners for environment inventory and trust administration.
Keep legacy settings, administration, admin, and platform/setup entry points usable without preserving the old split-product shells.

Owner shells:
- Setup > Topology
- Setup > Trust & Signing
Primary routes:
- /setup/topology/overview
- /setup/topology/map
- /setup/topology/regions
- /setup/topology/targets
- /setup/topology/hosts
- /setup/topology/agents
- /setup/topology/promotion-graph
- /setup/topology/workflows
- /setup/topology/gate-profiles
- /setup/topology/connectivity
- /setup/topology/runtime-drift
- /setup/trust-signing
- /setup/trust-signing/keys
- /setup/trust-signing/issuers
- /setup/trust-signing/certificates
- /setup/trust-signing/transparency
Relocated Trust & Signing tabs redirect to their current owners (bookmark redirects in src/Web/StellaOps.Web/src/app/features/trust-admin/trust-admin.routes.ts):
- /setup/trust-signing/watchlist and /setup/trust-signing/watchlist/:sub → /ops/operations/watchlist (definitions and pattern tests only; alert history is not available, see docs/modules/ui/watchlist-operations/README.md)
- /setup/trust-signing/audit, /setup/trust-signing/airgap and /setup/trust-signing/incidents → /evidence/audit-log/trust
- /setup/trust-signing/analytics → /ops/operations/trust-analytics
Secondary handoff route:
- /ops/platform-setup

Preserve stale bookmarks and old links by redirecting:
- /platform/setup
- /platform/setup/regions-environments
- /platform/setup/promotion-paths
- /platform/setup/workflows-gates
- /platform/setup/gate-profiles
- /platform/setup/trust-signing
- /platform/setup/trust-signing/:page
- /settings/trust
- /settings/trust/issuers
- /settings/trust/:page
- /administration/trust
- /administration/trust/issuers
- /administration/trust/:page
- /admin/trust
- /admin/trust/:page
- /admin/issuers
Redirects must preserve query params and fragments so tenant, region, environment, and tab context survive the handoff.

Platform Setup is a setup overview and handoff page, not the owner of topology or trust subtrees.
Topology owns region, environment, target, agent, promotion, workflow, gate-profile, connectivity, and runtime-drift navigation.
Trust & Signing owns keys, issuers, certificates and transparency; its former watchlist, audit, air-gap, incident and analytics tabs redirect to their current owners.
Legacy settings or admin trust URLs should land directly on the live trust shell instead of placeholder pages.

Keep:
- topology inventory and graph drill-ins
- promotion-path, workflow and gate-profile reference pages (they hold no tenant configuration; see docs/modules/ui/platform-setup-canonical-route-preservation/README.md)
- trust summary, issuer management, certificate inventory, and watchlist
- trust audit, incident, analytics, and air-gap administration
Why:
- these are core release-setup capabilities, not experimental side branches
- the product issue was weak wiring and stale route ownership, not missing product value

Canonical setup alias helpers for trust and platform-setup handoffs.
Top-level /admin/* compatibility redirects for trust and notification bookmarks.
Expanded Topology shell tabs so preserved mounted pages are reachable from the live setup shell.
Preserved canonical /ops/platform-setup/* leaf URLs while keeping explicit topology drill-ins under Setup > Topology.
Retired live trust-placeholder ownership in favor of the real Trust Management shell.