docs: address docs review comments on PR #991

- tables.md: fix backtick headings that rendered as guillemets in mdBook;
  also add CRYPTO_OFFICER_ACTIVATIONS entity to the erDiagram (it was
  missing from the overview diagram while documented in the prose below)
- configuration.md: replace the duplicated Redis-with-Findex intro and
  config block with links to the dedicated redis.md page
- redis.md: add missing redis_findex_label to the configuration examples
  and update the environment-variable list to include KMS_REDIS_FINDEX_LABEL

Author: Manuthor

documentation/docs/configuration/database/configuration.md

@@ -14,21 +14,9 @@ for scenarios that do not demand high availability.
 
 ### Redis with Findex
 
-**Redis with Findex** offers the ability to use Redis as a database with application-level encryption: all data is
-encrypted (using AES 256 GCM) by the KMS servers before being sent to
-Redis. [Findex](https://github.com/Cosmian/findex/) is an Eviden cryptographic algorithm used to build encrypted indexes
-on encrypted data, also stored in Redis. This allows the KMS to perform fast encrypted queries on encrypted data. Redis
-with Findex offers post-quantum resistance on encrypted data and encrypted indexes.
-
-**Redis-with-Findex** is most useful when:
-
-- KMS servers are run inside a confidential VM or an enclave. In this case, the secret used to encrypt the Redis data
-  and indexes, is protected by the VM or enclave and cannot be recovered at runtime by inspecting the KMS servers'
-  memory.
-- KMS servers are run by a trusted party but the Redis backend is managed by an untrusted third party.
-
-Redis-with-Findex is the database selected
-to [run the Eviden KMS in the cloud or any other zero-trust environment](../../installation/marketplace_guide.md).
+Redis-with-Findex provides application-level encryption over Redis, combining AES-256-GCM encrypted objects with
+encrypted Findex indexes. See the dedicated [Redis with Findex](./redis.md) page for a full description,
+encryption details, and configuration reference.
 
 ## Configuring the database
 
@@ -257,33 +245,7 @@ All use the same configuration with `database-type=mysql`.
 
 #### Redis with Findex
 
-For Redis with Findex, the `--redis-master-password` and `--redis-findex-label` options must also be specified:
-
-- The `redis-master-password` is the password from which keys will be derived (using Argon 2) to encrypt the Redis data
-  and indexes.
-- The `redis-findex-label` is a public, arbitrary label that can be changed to rotate the Findex ciphertexts without
-  changing the password/key.
-
-=== "kms.toml"
-
-    ```toml
-    [db]
-    database_type = "redis-findex"
-    database_url = "redis://localhost:6379"
-    redis_master_password = "password"
-    redis_findex_label = "label"
-    ```
-
-=== "Command line arguments"
-
-    ```sh
-    --database-type=redis-findex \
-    --database-url=redis://localhost:6379 \
-    --redis-master-password=password \
-    --redis-findex-label=label
-    ```
-
-- Redis (with-Findex), use:
+For Redis-with-Findex configuration, see the dedicated [Redis with Findex](./redis.md#configuration) page.
 
 ## Securing database connections with TLS / mTLS
 

documentation/docs/configuration/database/redis.md

@@ -59,17 +59,19 @@ Redis-with-Findex requires the database URL and a master password:
     database_type = "redis-findex"
     database_url = "redis://localhost:6379"
     redis_master_password = "password"
+    redis_findex_label = "label"
     ```
 
 === "Command line arguments"
 
     ```sh
     --database-type=redis-findex \
     --database-url=redis://localhost:6379 \
-    --redis-master-password=password
+    --redis-master-****** \
+    --redis-findex-label=label
     ```
 
-The corresponding environment variables are `KMS_DATABASE_TYPE`, `KMS_DATABASE_URL` (also `KMS_REDIS_URL`), and `KMS_REDIS_MASTER_PASSWORD`.
+The corresponding environment variables are `KMS_DATABASE_TYPE`, `KMS_DATABASE_URL` (also `KMS_REDIS_URL`), `KMS_REDIS_MASTER_PASSWORD`, and `KMS_REDIS_FINDEX_LABEL`.
 
 For the full database configuration reference, including TLS, clearing, and migration, see [Databases](./configuration.md).
 

documentation/docs/configuration/database/tables.md

@@ -45,9 +45,15 @@ erDiagram
         string id FK
         string tag
     }
+    CRYPTO_OFFICER_ACTIVATIONS {
+        timestamp activated_at
+        text sealed_record
+        timestamp revoked_at
+        varchar revoked_by
+    }
 ```
 
-## `objects`
+## objects
 
 The central table. One row per KMIP object.
 
@@ -68,7 +74,7 @@ The following secondary indexes are created on `objects`:
 | `idx_objects_state` | `state` |
 | `idx_objects_wrapping_key_id` | `wrapping_key_id` |
 
-## `read_access`
+## read_access
 
 Stores the operations that a given user is allowed to perform on a given object.
 
@@ -83,7 +89,7 @@ In PostgreSQL and SQLite it is declared `UNIQUE (id, userid)`; in MySQL (since 5
 
 A secondary index `idx_read_access_userid` is created on `userid`.
 
-## `tags`
+## tags
 
 Stores the tags attached to objects. Tags are used to locate objects by tag.
 
@@ -95,7 +101,7 @@ Stores the tags attached to objects. Tags are used to locate objects by tag.
 The pair (`id`, `tag`) is unique.
 In PostgreSQL and SQLite it is declared `UNIQUE (id, tag)`; in MySQL (since 5.13.0) it is the composite `PRIMARY KEY (id, tag)`.
 
-## `parameters`
+## parameters
 
 A generic key/value store used internally by the KMS for database metadata.
 
@@ -112,7 +118,7 @@ Known parameters:
 | `db_version` | The version of the KMS software that last ran against this database. |
 | `wrapping_key_id_backfilled` | A one-time marker recording that the `objects.wrapping_key_id` backfill has completed. |
 
-## `crypto_officer_activations`
+## crypto_officer_activations
 
 Records the Crypto Officer activation ceremony.
 One row is added each time the Crypto Officer role is activated via a split-key ceremony.