Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/Nginx_Proxy_Manager/compose.yml

@@ -0,0 +1,52 @@
+services:
+  nginx-proxy-manager:
+    image: jc21/nginx-proxy-manager:latest
+    container_name: nginx-proxy-manager
+    hostname: nginx-proxy-manager
+    domainname: nginx.gibbyb.com
+    networks: ['nginx-bridge']
+    restart: unless-stopped
+    ports:
+      - '80:80'
+      - '443:443'
+      # ⚠️ ONLY 81 moves. 80 and 443 above MUST stay on 0.0.0.0 — they are the
+      # public front door and firewalld already restricts them to Cloudflare ranges.
+      # 81 is the admin UI and is reached over WireGuard (http://192.168.2.2:81).
+      - '192.168.2.2:81:81' # Admin Web Port — WireGuard only
+      #- '21:21' # FTP
+      #- '22:22' # SSH
+      #- '25565:25565' # Minecraft
+    environment:
+      - TZ=America/New_York
+      - DB_POSTGRES_HOST
+      - DB_POSTGRES_PORT
+      - DB_POSTGRES_USER
+      - DB_POSTGRES_PASSWORD
+      - DB_POSTGRES_NAME
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+    volumes:
+      - ./volumes/data:/data:Z
+      - ./volumes/letsencrypt:/etc/letsencrypt:Z
+    #depends_on: [postgresql]
+
+  #postgresql:
+    #image: postgres:17
+    #container_name: nginx-proxy-manager-db
+    #hostname: nginx-proxy-manager-db
+    #networks: ['nginx-bridge']
+    #environment:
+      #POSTGRES_USER: 'npm'
+      #POSTGRES_PASSWORD: '<see this service .env on the machine>'
+      #POSTGRES_DB: 'npm'
+    #labels:
+      #com.centurylinklabs.watchtower.enable: 'true'
+    #volumes:
+      #- ./volumes/postgres:/var/lib/postgresql/data
+    #restart: unless-stopped
+
+networks:
+  # Created out-of-band so all nine stacks agree and there is no create race at boot:
+  #   podman network create --subnet 172.18.0.0/24 nginx-bridge
+  nginx-bridge:
+    external: true