Add comprehensive documentation for CLICD features and operations

- Introduced Container Management documentation covering lifecycle operations, resource management, and console access.
- Added Dashboard documentation detailing metrics and related APIs.
- Created Host Report documentation summarizing host environment and resource status.
- Included Image Management documentation for template handling and management actions.
- Documented Networking and Routing features including NAT4 and IPv6 management.
- Added Security Alerts documentation outlining alert scenarios and API usage.
- Created Snapshot Management documentation for snapshot operations and scheduling.
- Documented Sub-user management for granting access to specific containers.
- Added Configuration guide detailing runtime settings and security recommendations.
- Created Installation guide for setting up CLICD with requirements and steps.
- Added Introduction and Quick Start guides for new users.
- Documented Upgrade process with version checking and pre-upgrade checklist.
- Created Deployment guide for service exposure and firewall recommendations.
- Added FAQ section addressing common questions and concerns.
- Documented Troubleshooting steps for common issues encountered.

docs/en/operations/deployment.md

@@ -0,0 +1,46 @@
+# Deployment
+
+CLICD can run directly on the host or behind a reverse proxy. In production, set up access control before exposing it to administrators.
+
+## Service Exposure
+
+The default web port is `8999`:
+
+```text
+http://YOUR_SERVER_IP:8999
+```
+
+Recommendations:
+
+- Allow only fixed administrator IPs.
+- Use a reverse proxy with HTTPS.
+- Do not expose the real login URL in public docs or screenshots.
+
+## systemd
+
+Common commands:
+
+```bash
+systemctl status clicd
+systemctl restart clicd
+systemctl enable clicd
+journalctl -u clicd -f
+```
+
+## Firewall
+
+At minimum, confirm:
+
+- The panel port is open only to trusted sources.
+- NAT mapped ports are opened only as needed.
+- The SSH management port does not conflict with container mappings.
+- IPv6 firewall rules are planned together with IPv4 rules.
+
+## Backups
+
+Back up regularly:
+
+- CLICD configuration directory.
+- SQLite database.
+- Container configuration.
+- Snapshots or external data backups for important containers.

docs/en/operations/faq.md

@@ -0,0 +1,29 @@
+# FAQ
+
+## Which version does the installer install by default?
+
+It installs the latest version from GitHub Releases. The script default is `CLICD_VERSION=latest`, which downloads the Linux AMD64 artifact from `releases/latest`.
+
+## Can I pin a specific version?
+
+Yes:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo CLICD_VERSION=v1.1.6 sh
+```
+
+## Can sub-users see every container?
+
+No. Sub-users only see containers authorized by the administrator.
+
+## Is an API key the same as the login password?
+
+No. API keys are created on the API Integration page for programmatic access. The login password is used for the web panel.
+
+## What happens after a container reaches its traffic limit?
+
+The container is automatically shut down to avoid further overage. The administrator can adjust the limit or reset traffic usage.
+
+## Why is IPv6 unreachable after assignment?
+
+IPv6 reachability depends on the host and upstream network. Confirm that the host has a routable IPv6 prefix and that routing, firewall, neighbor discovery, or proxy configuration is correct.

docs/en/operations/troubleshooting.md

@@ -0,0 +1,46 @@
+# Troubleshooting
+
+## Service Not Reachable
+
+Check service status:
+
+```bash
+systemctl status clicd
+journalctl -u clicd -n 100 --no-pager
+```
+
+Check port listening:
+
+```bash
+ss -lntp | grep 8999
+```
+
+If a reverse proxy is used, check proxy logs and upstream address settings as well.
+
+## Image Download Failed
+
+- Make sure the host can access image sources and GitHub Releases.
+- Check disk space.
+- Review the failure reason in the task queue.
+- If a download is stuck, cancel it and start again.
+
+## Container Cannot Access the Network
+
+- Check host NAT and forwarding rules.
+- Confirm that the container IP was assigned successfully.
+- Check whether the firewall is blocking forwarded traffic.
+- For IPv6, confirm that the upstream network routes the prefix to the host.
+
+## WebSSH or WebVNC Connection Failed
+
+- Confirm that the container or virtual machine is running.
+- WebSSH requires SSH service inside the container.
+- WebVNC requires the KVM console to be reachable.
+- Tickets expire quickly. Create a new ticket after expiration.
+
+## API Returns Unauthorized
+
+- Confirm that the API key is not disabled.
+- Use `X-API-Key` or `Authorization: Bearer`.
+- Confirm that the key scope covers the target endpoint.
+- Do not use the panel login password as an API key.