Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/UseSend/.env.example

@@ -0,0 +1,22 @@
+API_RATE_LIMIT=1
+AUTH_AUTHENTIK_ID=CHANGE_ME
+AUTH_AUTHENTIK_SECRET=CHANGE_ME
+AUTH_AUTHENTIK_ISSUER="https://auth.gbrown.org/application/o/gibsend/"
+AWS_ACCESS_KEY=CHANGE_ME
+AWS_SECRET_KEY=CHANGE_ME
+AWS_DEFAULT_REGION=us-east-2
+DATABASE_URL=CHANGE_ME
+GITHUB_ID=Ov23liz34colyJed9t9S
+GITHUB_SECRET=CHANGE_ME
+MINIO_ROOT_USER=usesend
+MINIO_ROOT_PASSWORD=CHANGE_ME
+NEXTAUTH_SECRET=CHANGE_ME
+NEXT_PUBLIC_IS_CLOUD=false
+POSTGRES_USER=usesend
+POSTGRES_PASSWORD=CHANGE_ME
+POSTGRES_DB=usesend
+REDIS_URL=redis://usesend-redis:6379
+SMTP_HOST=smtp.usesend.gbrown.org
+SMTP_USER=usesend
+USESEND_PORT=3000
+USESEND_URL=https://usesend.gbrown.org