Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/Portainer/compose.yml

@@ -0,0 +1,31 @@
+services:
+  portainer:
+    image: portainer/portainer-ee:latest
+    container_name: portainer
+    hostname: portainer
+    domainname: port.gibbyb.com
+    networks:
+      - nginx-bridge
+    environment:
+      - TZ=America/New_York
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    ports:
+      # WireGuard address only — this admin UI has no business on the public
+      # interface. It has its own login and the Hetzner firewall does not admit this
+      # port, so this is defence in depth: it removes the dependency on a firewall rule
+      # set that lives in a web console. See AGENTS.md §13.2.
+      - 192.168.2.2:9443:9443
+    # Required under SELinux Enforcing to reach the rootless podman socket, which
+    # systemd recreates at each boot with a non-container label. The socket mount
+    # deliberately has no :Z -- relabeling the live socket would break podman itself.
+    security_opt: ['label:disable']
+    volumes:
+      - ./volumes/data:/data:Z
+      - /run/user/1000/podman/podman.sock:/var/run/docker.sock
+    tty: true
+    restart: unless-stopped
+
+networks:
+  nginx-bridge:
+    external: true