Snapshot both servers: the VPS catalog moves to server/vps, the home server joins as server/home

The catalog in server/containers had drifted from the VPS. Eleven compose
files and twelve units no longer matched what runs, and two running
services, Gbrown_Agent and BillTracker, were missing. server/vps is now a
copy of the live files, and panama-server reads from it.

server/home holds the home server's services in the same shape. They still
run under Docker, so the podman units there are drafts for a later move, and
nothing installs from that tree. PostHog, Sentry and Plausible are checkouts
of upstream repositories. Only their local files are kept, next to an
UPSTREAM file naming the repository and the exact commit.

Every secret in both trees is a ${VAR} reference named in .env.example, or
CHANGE_ME in files that are not compose files. The live servers still hold
some of those values inline, so a live file can differ from its copy on
those lines alone. Existing .env.example files keep their comments, with new
keys appended at the end.

The ignore rules and the secrets contract now cover both trees, plus the
volume/ and volumes/ directories the home server uses.

server/vps/Documenso/compose.yml

@@ -0,0 +1,72 @@
+# Documenso — VPS (ROOTLESS PODMAN). Ported from the home server 2026-08-12.
+#
+# ⚠️ NOT STARTED. No systemd unit is enabled for this. It has never run on either
+# machine, so there is no data to migrate. Bring it up with:
+#     systemctl --user enable --now podman-documenso.service
+#
+# BEFORE FIRST START, two things must happen:
+#
+#   1. Create its role and database on the SHARED postgres (this stack no longer
+#      ships its own):
+#        podman exec -i postgresql psql -U npm <<'SQL'
+#        CREATE ROLE documenso LOGIN PASSWORD 'e2bf60b34aff8ce259e5ed42da46c9c6';
+#        CREATE DATABASE documenso OWNER documenso;
+#        SQL
+#      Then add the same lines to PostgreSQL/initdb/00-roles-and-databases.sql so a
+#      rebuild recreates them.
+#
+#   2. Provide a signing certificate at ./volumes/cert/cert.p12, or Documenso will
+#      not start. Generate one with:
+#        openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 3650 -nodes
+#        openssl pkcs12 -export -out cert.p12 -inkey key.pem -in cert.pem -passout pass:
+#
+# Also unset: the four NEXT_PRIVATE_SMTP_* values are still CHANGE_ME. Documenso will
+# run without working email, but signature invitations will fail to send.
+#
+# Rootless adaptations from the home version:
+#   - Dropped its private postgres:16-alpine; uses the shared instance (AGENTS.md §2).
+#   - :Z on bind mounts (SELinux Enforcing).
+#   - /etc/localtime mounts removed in favour of TZ (AGENTS.md §8).
+#
+# NPM: proxy docs.gbrown.org -> http://documenso:3000
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  documenso:
+    image: docker.io/documenso/documenso:latest
+    container_name: documenso
+    hostname: documenso
+    domainname: docs.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+      - PORT=3000
+      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
+      - NEXT_PRIVATE_ENCRYPTION_KEY=${NEXT_PRIVATE_ENCRYPTION_KEY}
+      - NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=${NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY}
+      - NEXT_PUBLIC_WEBAPP_URL=https://docs.gbrown.org
+      - NEXTAUTH_URL=https://docs.gbrown.org
+      # Shared postgres, not a private container
+      - NEXT_PRIVATE_DATABASE_URL=${NEXT_PRIVATE_DATABASE_URL}
+      - NEXT_PRIVATE_DIRECT_DATABASE_URL=${NEXT_PRIVATE_DIRECT_DATABASE_URL}
+      - NEXT_PRIVATE_SIGNING_TRANSPORT=local
+      - NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/cert.p12
+      - NEXT_PRIVATE_SIGNING_PASSPHRASE=
+      - NEXT_PUBLIC_UPLOAD_TRANSPORT=database
+      - NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth
+      - NEXT_PRIVATE_SMTP_HOST=CHANGE_ME
+      - NEXT_PRIVATE_SMTP_PORT=587
+      - NEXT_PRIVATE_SMTP_USERNAME=CHANGE_ME
+      - NEXT_PRIVATE_SMTP_PASSWORD=CHANGE_ME
+      - NEXT_PRIVATE_SMTP_FROM_NAME=Documenso
+      - [email protected]
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./volumes/cert/cert.p12:/opt/documenso/cert.p12:Z
+    tty: true
+    stdin_open: true
+    restart: unless-stopped