Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/CalCom/compose.yml

@@ -0,0 +1,60 @@
+# Cal.com — VPS (ROOTLESS PODMAN). Ported from the home server 2026-08-12.
+#
+# ⚠️ NOT STARTED. No systemd unit is enabled. It has never run on either machine, so
+# there is no data to migrate. Bring it up with:
+#     systemctl --user enable --now podman-calcom.service
+#
+# BEFORE FIRST START, create its role and database on the SHARED postgres (this stack
+# no longer ships its own):
+#     podman exec -i postgresql psql -U npm <<'SQL'
+#     CREATE ROLE calcom LOGIN PASSWORD '<see this service .env on the machine>';
+#     CREATE DATABASE calcom OWNER calcom;
+#     SQL
+# Then add the same lines to PostgreSQL/initdb/00-roles-and-databases.sql.
+#
+# Also unset: EMAIL_SERVER_HOST/USER/PASSWORD are still CHANGE_ME. Cal.com will run,
+# but booking confirmations and invitations will not send.
+#
+# Note Cal.com runs database migrations on first boot and can take several minutes to
+# become responsive. The unit allows 900s for this.
+#
+# Rootless adaptations from the home version:
+#   - Dropped its private postgres:16-alpine; uses the shared instance (AGENTS.md §2).
+#   - /etc/localtime mount removed in favour of TZ (AGENTS.md §8).
+#   - No bind mounts remain, so no :Z is needed.
+#
+# NPM: proxy cal.gbrown.org -> http://calcom:3000
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  calcom:
+    image: docker.io/calcom/cal.com:latest
+    container_name: calcom
+    hostname: calcom
+    domainname: cal.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+      - NEXT_PUBLIC_WEBAPP_URL=https://cal.gbrown.org
+      - NEXT_PUBLIC_WEBSITE_URL=https://cal.gbrown.org
+      - NEXTAUTH_URL=https://cal.gbrown.org/api/auth
+      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
+      - CALENDSO_ENCRYPTION_KEY=${CALENDSO_ENCRYPTION_KEY}
+      # Shared postgres, not a private container
+      - DATABASE_URL=${DATABASE_URL}
+      - DATABASE_DIRECT_URL=${DATABASE_DIRECT_URL}
+      - NEXT_PUBLIC_LICENSE_CONSENT=agree
+      - ALLOWED_HOSTNAMES="cal.gbrown.org"
+      - [email protected]
+      - EMAIL_SERVER_HOST=CHANGE_ME
+      - EMAIL_SERVER_PORT=587
+      - EMAIL_SERVER_USER=CHANGE_ME
+      - EMAIL_SERVER_PASSWORD=${EMAIL_SERVER_PASSWORD}
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    tty: true
+    stdin_open: true
+    restart: unless-stopped