Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

tests/server/compose-secrets-contract

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+
+# This repository is public, and server/ describes real infrastructure. The
+# rule that makes that safe has three parts, and each is pinned here because
+# each fails silently:
+#
+#   1. No tracked file under server/ carries a secret. Compose files reference
+#      secrets as ${VAR} interpolations resolved from the .env beside them on
+#      the machine; .env.example names the variables with CHANGE_ME in place
+#      of every value that matters.
+#   2. .gitignore keeps .env and data/ out of server/containers/ even when a
+#      cutover or a mistake puts one there. The live files belong in
+#      ~/Server/<Name>/, outside the checkout entirely -- the ignore is a
+#      seatbelt, and a seatbelt that got deleted should fail loudly.
+#   3. Nothing named .env is tracked, full stop.
+
+set -uo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+server_dir="$repo_dir/server"
+
+findings=()
+note() { findings+=("$1"); }
+
+[[ -d "$server_dir" ]] || { printf 'compose secrets contract: no server/ directory\n' >&2; exit 1; }
+
+# ── 1. Tracked content is clean ──────────────────────────────────────────────
+#
+# Only tracked files: the live .env a cutover briefly leaves in a service
+# directory is exactly what the gitignore exists for, and flagging it here
+# would punish the ignore for working.
+
+while IFS= read -r file; do
+    path="$repo_dir/$file"
+    [[ -f "$path" ]] || continue
+
+    # A secret-bearing key with a literal value. ${VAR} interpolations, empty
+    # values, the CHANGE_ME placeholder, and booleans (ALLOW_EMPTY_PASSWORD=yes
+    # is a switch, not a credential) are the allowed shapes; anything else
+    # after PASSWORD/SECRET/TOKEN/KEY is treated as a leak. Keys that merely
+    # configure where a secret lives (a *_FILE path, a key NAME) are not
+    # values.
+    while IFS= read -r hit; do
+        note "$file looks like it carries a secret: ${hit%%[=:]*}"
+    done < <(grep -inE '(password|secret|token|api_key|private_key|access_key)[a-z0-9_]*[[:space:]]*[:=]' "$path" 2>/dev/null \
+        | grep -vE '[:=][[:space:]]*["'"'"']?(\$\{|CHANGE_ME|(true|false|yes|no|[01])["'"'"']?[[:space:]]*$|["'"'"']?[[:space:]]*$)' \
+        | grep -viE '(_file|_path|_name|_key_name)[[:space:]]*[:=]' \
+        | grep -vE '^[0-9]+:[[:space:]]*#')
+
+    if grep -qE 'BEGIN [A-Z ]*PRIVATE KEY' "$path" 2>/dev/null; then
+        note "$file contains a private key"
+    fi
+    if grep -qE 'sk-ant-[A-Za-z0-9]|ghp_[A-Za-z0-9]{20}|xox[baprs]-[A-Za-z0-9]' "$path" 2>/dev/null; then
+        note "$file contains something that looks like an API token"
+    fi
+done < <(git -C "$repo_dir" ls-files 'server/')
+
+# ── 2. The ignore still stands ───────────────────────────────────────────────
+#
+# check-ignore consults the real gitignore for a path that need not exist, so
+# this asserts the rule rather than the current absence of violations.
+
+git -C "$repo_dir" check-ignore -q 'server/containers/AnyService/.env' \
+    || note '.gitignore no longer covers .env under server/containers/'
+git -C "$repo_dir" check-ignore -q 'server/containers/AnyService/data/dump.sql' \
+    || note '.gitignore no longer covers data/ under server/containers/'
+
+# ── 3. No .env is tracked ────────────────────────────────────────────────────
+
+while IFS= read -r tracked; do
+    note "a live .env is tracked: $tracked"
+done < <(git -C "$repo_dir" ls-files 'server/**/.env' 'server/.env')
+
+# ── Report ───────────────────────────────────────────────────────────────────
+
+if (( ${#findings[@]} > 0 )); then
+    mapfile -t findings < <(printf '%s\n' "${findings[@]}" | sort -u)
+    printf 'compose secrets contract: %d finding(s)\n' "${#findings[@]}" >&2
+    printf '  - %s\n' "${findings[@]}" >&2
+    exit 1
+fi
+
+printf 'compose secrets contract: PASS\n'