feat(operations): support canonical source providers

vehicle-data-platform/docs/deployment.md

@@ -158,6 +158,8 @@ Production smoke must create an export for an active VIN, wait for `completed`,
 
 Before a customer demonstration, run `deploy/verify-customer-demo.py` with the password supplied only through `DEMO_PASSWORD`. The gate logs in as the actual customer, requires the exact four customer menus, compares the complete realtime VIN set with the approved cohort, verifies representative source/location states, confirms an out-of-Scope VIN cannot resolve, checks optional track and mileage evidence, loads the four customer SPA routes and logs out. The script never creates an account, changes grants or persists the password; account identity and VIN Scope must be approved separately. See `docs/customer-demo-acceptance.md`.
 
+For an authoritative JT808 provider list, use `deploy/import-source-providers.py`. The command reads its administrator credential only from `SOURCE_PROVIDER_ADMIN_TOKEN`. `--export-missing <new.csv>` produces an Excel-compatible, masked template for current provider gaps and refuses to overwrite an existing path. A filled CSV must first pass the default read-only preflight; add `--apply` only after reviewing the `ready` summary. The importer validates every row before the first write, preserves the current enabled state, priority and policy remark, and updates only provider/evidence through the audited optimistic-version API. Protocol-level canonical snapshots receive an opaque provider reference even when no independent location source exists, but their terminal policy fields remain read-only. The importer stops on source/protocol/current-provider drift and never accepts a missing evidence reference. See `docs/meeting-goal-external-input-handoff.md`.
+
 `AUTH_MODE=enforce` is mandatory on ECS. Tokens are stored as SHA-256 comparisons in memory and sent as Bearer credentials; the browser stores the entered token only in `sessionStorage`. Roles are cumulative:
 
 | Role | Permissions |