Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/StPeteIT/.env.example

@@ -0,0 +1,58 @@
+# Since .env is gitignored, you can use .env.example to build a new `.env` file when you clone the repo.
+# Keep this file up-to-date when you add new variables to \`.env\`.
+# This file will be committed to version control, so make sure not to have any secrets in it.
+# If you are cloning this repo, create a copy of this file named `.env` and populate it with your secrets.
+
+## Next App ##
+NODE_ENV=production
+SENTRY_AUTH_TOKEN=CHANGE_ME
+PAYLOAD_SECRET=CHANGE_ME
+PAYLOAD_DB_URL=CHANGE_ME
+NEXT_PUBLIC_SITE_URL=https://stpeteit.com
+NEXT_PUBLIC_CONVEX_URL=https://api.stpeteit.com # convex-backend:3210
+NEXT_PUBLIC_PLAUSIBLE_URL=https://plausible.gbrown.org
+NEXT_PUBLIC_SENTRY_DSN=https://[email protected]/5
+NEXT_PUBLIC_SENTRY_URL=https://sentry.gbrown.org
+NEXT_PUBLIC_SENTRY_ORG=sentry
+NEXT_PUBLIC_SENTRY_PROJECT_NAME=stpeteit-next
+
+## Convex ##
+CONVEX_SELF_HOSTED_URL=https://api.stpeteit.com # convex-backend:3210
+CONVEX_SELF_HOSTED_ADMIN_KEY=CHANGE_ME
+# Convex Auth
+CONVEX_SITE_URL=https://stpeteit.com # convex-backend:3211
+USESEND_API_KEY=CHANGE_ME
+USESEND_URL=https://usesend.gbrown.org
+USESEND_FROM_EMAIL='St Pete IT Admin <[email protected]>'
+AUTH_AUTHENTIK_ID=CHANGE_ME
+AUTH_AUTHENTIK_SECRET=CHANGE_ME
+AUTH_AUTHENTIK_ISSUER=https://auth.gbrown.org/application/o/stpeteit/
+
+## Docker Compose Variables for Next App ##
+NETWORK=nginx-bridge
+NEXT_CONTAINER_NAME=stpeteit-next
+NEXT_DOMAIN=stpeteit.com
+#NEXT_PORT=3000
+
+## Docker Compose Variables for Self hosted Convex ##
+BACKEND_TAG=latest
+DASHBOARD_TAG=latest
+BACKEND_CONTAINER_NAME=stpeteit-backend
+DASHBOARD_CONTAINER_NAME=stpeteit-dashboard
+BACKEND_DOMAIN=convex.stpeteit.com
+DASHBOARD_DOMAIN=dashboard.stpeteit.com
+INSTANCE_NAME=stpeteit-convex
+#INSTANCE_SECRET=
+CONVEX_CLOUD_ORIGIN=https://api.stpeteit.com
+CONVEX_SITE_ORIGIN=https://convex.stpeteit.com
+NEXT_PUBLIC_DEPLOYMENT_URL=https://api.stpeteit.com
+DISABLE_BEACON=true
+REDACT_LOGS_TO_CLIENT=true
+DO_NOT_REQUIRE_SSL=true
+POSTGRES_URL=CHANGE_ME
+#BACKEND_PORT=
+#DASHBOARD_PORT
+#SITE_PROXY_PORT=
+#ACTIONS_USER_TIMEOUT_SECS=
+#RUST_LOG=
+#RUST_BACKTRACE=