Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/UseSend/compose.yml

@@ -0,0 +1,88 @@
+name: usesend
+networks:
+  nginx-bridge:
+    external: true
+services:
+  redis:
+    image: redis:7
+    container_name: usesend-redis
+    hostname: usesend-redis
+    networks:
+    - nginx-bridge
+    env_file: .env
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+    volumes:
+    - ./volumes/redis:/data:Z
+    command:
+    - redis-server
+    - --maxmemory-policy
+    - noeviction
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
+  minio:
+    image: minio/minio
+    container_name: usesend-storage
+    hostname: usesend-storage
+    networks:
+    - nginx-bridge
+    env_file: .env
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+    volumes:
+    - ./volumes/minio:/data:Z
+    entrypoint: sh
+    command: -c 'mkdir -p /data/unsend && minio server /data --console-address ':9001' --address ':9002''
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
+  smtp-server:
+    image: usesend/smtp-proxy:v1.6.6
+    container_name: usesend-smtp-server
+    hostname: usesend-smtp
+    networks:
+    - nginx-bridge
+    env_file: .env
+    environment:
+    - SMTP_AUTH_USERNAME=${SMTP_USER:?err}
+    - USESEND_BASE_URL=${USESEND_URL:?err}
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
+  usesend:
+    image: usesend/usesend:v1.6.6
+    container_name: usesend
+    hostname: usesend
+    domainname: ${USESEND_URL:?err}
+    networks:
+    - nginx-bridge
+    env_file: .env
+    environment:
+    - PORT=${USESEND_PORT:-3000}
+    - DATABASE_URL=${DATABASE_URL:?err}
+    - NEXTAUTH_URL=${USESEND_URL:?err}
+    - NEXTAUTH_SECRET=${NEXTAUTH_SECRET:?err}
+    - AWS_ACCESS_KEY=${AWS_ACCESS_KEY:?err}
+    - AWS_SECRET_KEY=${AWS_SECRET_KEY:?err}
+    - AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION:?err}
+    - GITHUB_ID=${GITHUB_ID:?err}
+    - GITHUB_SECRET=${GITHUB_SECRET:?err}
+    - REDIS_URL=${REDIS_URL:?err}
+    - NEXT_PUBLIC_IS_CLOUD=${NEXT_PUBLIC_IS_CLOUD:-false}
+    - API_RATE_LIMIT=${API_RATE_LIMIT:-1}
+    - SMTP_HOST=${SMTP_HOST:-smtp.usesend.gbrown.org}
+    - SMTP_USER=${SMTP_USER:-usesend}
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+    depends_on:
+      redis:
+        condition: service_started
+    tty: true
+    stdin_open: true
+    restart: unless-stopped