docs: add real SOC Board screenshot and Copy Debug Prompt finding

Found by actually re-checking the running function instead of stopping
at what was already written: each finding has a "Copy Debug Prompt"
button generating a ready-to-paste AI-triage prompt, with a built-in
"don't act without approval" instruction baked into the template
itself. Embedded the real board screenshot (redacted) - dependency
ladder, Wazuh KPIs, Active Issues strip, per-host tile grid - since a
doc about a visual dashboard needs to actually show it, not just
describe it in command output.

docs/dashy-soc-board.md

@@ -37,9 +37,33 @@ Dashy's own built-in widget types cover simple cases well, but none of them can
 
 A top row shows a 6-tier infrastructure dependency ladder (mirroring the trust-boundary structure in [`docs/architecture-overview.md`](architecture-overview.md)) alongside fleet-wide 24-hour KPIs. Below that, an "Active Issues" strip surfaces the worst findings fleet-wide, followed by a grid of per-host tiles — worst-severity badge, error sparkline, sorted consistently. Clicking a tile expands a full detail panel: compliance and resource gauges, that host's folded-in specialty widget where relevant (a Vault seal-state panel on the secrets host, a Wazuh compliance ring on any host, and so on), and findings grouped by category.
 
+This is the real board, not a mockup of the layout — the dependency ladder, the Wazuh 24h KPIs, the Active Issues strip (clean here — no critical/serious findings at the time this was captured), and the per-host tile grid with real sparklines and error counts:
+
+![The real SOC Board: a 6-tier dependency ladder and fleet-wide Wazuh KPIs on top, an Active Issues strip below that, then a grid of per-host tiles with severity badges and 24h error sparklines](../assets/dashy-soc-board.png)
+
 > [!TIP]
 > **Deliberately scoped**: security/error/warning signal only. Per-app uptime is handled separately by Dashy's own native status checks on individual tiles — the only up/down signal inside this board is *infrastructure-tier* reachability from Prometheus, not per-app availability. Keeping the scope narrow — resisting the temptation to also make this the uptime dashboard — is what keeps the board actually scannable instead of turning into a second copy of Grafana.
 
+## Every finding ships with a ready-made AI-triage prompt
+
+Each finding's expanded row has a "Copy Debug Prompt" button, not just an acknowledge control. Clicking it builds a fully-formed prompt from that specific finding's own host, severity, title, and detail, and copies it straight to the clipboard — meant to be pasted directly into an AI assistant to start triage immediately, no manual context-gathering first. This is the real template, not a summary of it:
+
+```
+Investigate and help me fix this issue found on my homelab SOC board:
+
+Host: {hostId}
+Severity: {severity}
+Issue: {title}
+Detail: {meta}
+
+{body}
+
+Please diagnose the root cause and propose a fix. Do not execute or
+change anything without my explicit approval first.
+```
+
+That last line isn't incidental — the generated prompt itself carries the same "diagnose first, don't act without approval" discipline this entire fleet is operated under, baked into the one artifact most likely to get handed straight to an AI assistant with no other context attached.
+
 ## Acknowledge mechanism: client-side, no backend
 
 ![A finding's stable key (hostId::group::title) gets acknowledged into the browser's localStorage as a flat map, which live re-derives the host tile badge, the Active Issues strip, and any open detail panel's gauges — and never touches Wazuh, Slack, or any other upstream source](../assets/dashy-soc-board-acknowledge.svg)