When DR fires at 2am, operator opens /runbooks and reads the
procedure inline. No tabbing to docs. Read-only — operators read
here, execute outside (runbooks may reference operational secrets
in text; never embed "execute this command" buttons).

§2 verification: of the 5 PM-pre-listed paths, only docs/deploy-fly-io.md
is currently vendored into this repo (5113 bytes; shipped by
KR-P2-F-pre ST3). The 4 kora_docs/* paths reference a separate repo
(rafe-walker/kora-docs); they surface as "[runbook pending]"
placeholders so operators see the manifest acknowledges them but
they're not authored yet.

Reused web/src/components/Markdown.tsx (already in the project —
code blocks / headers / lists / inline code / links / horizontal
rules). No new markdown lib added.

Backend (kora_cli/web_server.py):
  * Explicit _RUNBOOK_MANIFEST: Dict[str, (title, repo-relative path)].
    NOT auto-discovered — ops want a stable known index, not a
    wandering scan of every .md.
  * GET /api/runbooks — manifest endpoint. One entry per pinned tuple
    with available + size_bytes + last_modified populated for files
    actually present; nulls for placeholders.
  * GET /api/runbooks/{runbook_id}/content — raw markdown response
    (text/markdown content-type). Defensive on multiple axes:
      1. id regex ^[a-z][a-z0-9_]*$ rejects ../etc/passwd, etc.
         (WARN logged so ops can spot traversal attempts).
      2. id is only ever a dict-key lookup against the manifest —
         user input is never concatenated into a path.
      3. Resolved path verified is_relative_to(repo_root) — belt+braces
         against a future manifest typo using ".." absolute paths.
      4. 1 MiB size cap (returns 413 if exceeded).
      5. Manifest entry exists but file missing → 404 with
         "not yet authored" message (FE renders placeholder card —
         distinct from "unknown id").
  * Repo root resolved via __file__ (stable across uvicorn launch dirs).

Frontend (web/):
  * pages/RunbooksPage.tsx — sidebar/content 280px+1fr grid (single-
    column on mobile). Sidebar lists runbooks with available/
    unavailable icon + title + path; click selects. Content pane:
      - No selection → empty-state "Select a runbook from the sidebar"
      - Selected + unavailable → "[runbook pending]" placeholder card
        with expected-path callout
      - Selected + available + loading → spinner
      - Selected + available + loaded → reused Markdown component
        renders the body inside a max-h-[calc(100vh-260px)] scroll
        container; header strip shows title + path + size + last-
        modified relative+absolute + Print button
  * Print button triggers window.print() — operators get a paper
    copy at 2am if they want one (markdown renders fine through
    default print styles).
  * lib/api.ts — new fetchText() helper (mirrors fetchJSON's session
    token injection + non-2xx-throws but returns res.text() instead
    of res.json()). RunbookEntry + RunbooksManifest interfaces;
    getRunbooks + getRunbookContent client methods.
  * App.tsx — /runbooks route + nav entry (BookOpenCheck icon) at
    END of nav per spec §3 (operator looks for it specifically;
    doesn't need top placement).

Tests: tests/kora_cli/test_web_server_runbooks.py — 11 tests
covering all 7 §5 scenarios plus extras:
  * deploy_fly_io always-available contract guard (pins the in-repo
    runbook against future repo reorganization)
  * Multiple traversal pattern guards (.., ../etc, foo/bar, foo\\bar,
    UPPERCASE, leading digit, internal whitespace all 404)
  * Manifest-path-outside-root refused (belt+braces against typo)
  * Defensive size cap with mocked oversized file
  * Unavailable-vs-unknown distinction: dr_runbook (manifest entry,
    file missing) returns 404 with "not yet authored" — distinguishable
    from "unknown id" so FE renders placeholder rather than error
140/140 admin-panel suite green (test_web_server_cron_profiles
omitted — 5 pre-existing failures from KR-P2-D ST2 work_class
requirement; not mine).
tsc -b + vite build clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>