Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/Vaultwarden/compose.yml

@@ -0,0 +1,55 @@
+# Vaultwarden — VPS (ROOTLESS PODMAN) port of the home server's ~/Server/vaultwarden,
+# staged 2026-08-12.
+#
+# ⚠️ STAGED, NOT AUTHORITATIVE. The home instance is still live and still serving
+# vault.gbrown.org. This copy holds a point-in-time snapshot of the SQLite database.
+# DO NOT log into this one and add credentials before cutover -- the two would diverge
+# and one side's changes would be lost.
+#
+# Cutover procedure (do it in this order, it matters):
+#   1. stop vaultwarden on the home server        (clean SQLite, no torn WAL)
+#   2. rsync -a server.gib:~/Server/vaultwarden/volume/ ~/Server/Vaultwarden/volume/
+#   3. systemctl --user restart podman-vaultwarden
+#   4. point vault.gbrown.org at the VPS, add the NPM proxy host
+#   5. verify a login + an item decrypts, THEN leave home stopped
+#
+# The SQLite copy taken while home was running is crash-consistent only. Step 1 is what
+# makes it clean -- don't skip it.
+#
+# Rootless adaptations:
+#   - :Z on the data mount (SELinux Enforcing).
+#   - /etc/localtime mount dropped in favour of TZ (AGENTS.md §8).
+#   - No published port; NPM proxies to http://vaultwarden:80 over nginx-bridge.
+#   - Image starts as root and drops privileges internally, so no userns_mode needed.
+#
+# NOTE: ADMIN_TOKEN is inline here, matching the home server's file verbatim. It grants
+# access to /admin. Worth moving to a mode-600 .env at some point -- compose files get
+# rsynced offsite by ~/Server/backup.
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  vaultwarden:
+    image: docker.io/vaultwarden/server:latest
+    container_name: vaultwarden
+    hostname: vaultwarden
+    domainname: vault.gbrown.org
+    networks:
+      - nginx-bridge
+    environment:
+      - TZ=America/New_York
+      - DOMAIN=https://vault.gbrown.org
+      - LOGIN_RATELIMIT_MAX_BURST=10
+      - LOGIN_RATELIMIT_SECONDS=60
+      - WEB_VAULT_ENABLED=true
+      - SIGNUPS_ALLOWED=false
+      - WEBSOCKET_ENABLED=true
+      - ADMIN_TOKEN=${ADMIN_TOKEN}
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./volume:/data:Z
+    tty: true
+    restart: unless-stopped