Gateway: T3 RPC client, host connection, awareness port, storage, API contract

docs/plan.md

@@ -130,8 +130,9 @@ to end check is a manual run against server-gib's own T3 before deploying.
 - Nginx Proxy Manager gets a proxy host for `wristcode.gbrown.org` that points at
   `wristcode-gateway:8080`, using the `*.gbrown.org` certificate. DNS and the Cloudflare tunnel
   already cover the subdomain.
-- Deploys: Watchtower pulls `:latest` nightly. A `wristcode` entry in `~/Server/ci-deploy.sh` would
-  make deploys immediate after CI.
+- Deploys: after pushing the image, CI calls `~/Server/ci-deploy.sh wristcode` on server-gib over
+  SSH with a deploy key, which pulls and restarts the stack. Watchtower's nightly pull is the
+  fallback.
 - Local development: `bun --watch src/main.ts` against real T3 hosts, with no local image builds.
 
 ## Watch app
@@ -193,11 +194,10 @@ Phases 1 and 2 happen on the Fedora desktop. Phase 4 runs on the Mac mini in par
 phase 2 API is fixed. The gateway owns `gateway/`, the Mac mini owns `watch/`, and both pull before
 they push to `docs/`.
 
-## Open decisions
+## Decisions
 
-- **Runtime mode for threads started from the watch.** Either inherit the host's default
-  (`full-access` on these hosts) or force `approval-required`, so that anything risky waits for a
-  tap on the wrist.
-- **Instant deploys.** Add a `wristcode` entry to `~/Server/ci-deploy.sh` with a CI deploy key, or
-  rely on Watchtower's nightly pull.
-- **Bundle ID.** For example `org.gbrown.wristcode`.
+- Threads started from the watch inherit the host's default runtime mode (`full-access` on these
+  hosts).
+- CI deploys right away through a `wristcode` entry in `~/Server/ci-deploy.sh`, with Watchtower's
+  nightly pull as the fallback.
+- The bundle ID is `org.gbrown.wristcode`.