Docs: public README, setup guide and architecture, generic deploy files, and the T3 Code notice

deploy/compose.yml

@@ -1,34 +1,22 @@
-# A copy of the stack on junior.gib (the VPS). The live file is server/vps/Wristcode/compose.yml in
-# gib/Panama, symlinked into ~/Server/Wristcode/, beside podman-wristcode.service.
+# The WristCode gateway as one container with one SQLite file. Put it behind a reverse proxy that
+# serves HTTPS on a public name, such as wristcode.example.com, and forwards to port 8080. The
+# watch needs that name reachable over cellular.
 #
-# WristCode gateway: the backend for the WristCode Apple Watch app (git.gbrown.org/gib/wristcode).
-# It holds a WebSocket to every T3 Code server, serves the watch's HTTPS API, and sends APNs pushes.
-# NPM serves wristcode.gbrown.org and forwards to wristcode-gateway:8080 over nginx-bridge.
+# .env beside this file (mode 600). See .env.example.
 #
-# .env beside this file (mode 600):
-#   APNS_KEY_ID=...                the APNs key's ID
-#   APNS_TEAM_ID=GQJNM5YK2M
-#   APNS_KEY_PATH=/data/apns.p8    the .p8 file, in ./data
-#
-# Operator CLI: podman exec -it wristcode-gateway wristcode <host add|pair|device list|...>
-networks:
-  nginx-bridge:
-    external: true            # ALWAYS external; see AGENTS.md §5
-
+# Operator CLI: docker compose exec gateway wristcode <host add|pair|host list|device list|...>
 services:
-  wristcode-gateway:
-    image: git.gbrown.org/gib/wristcode-gateway:latest
+  gateway:
+    image: ${WRISTCODE_IMAGE:-wristcode-gateway:latest}
+    build:
+      context: ../gateway
+      dockerfile: Containerfile
     container_name: wristcode-gateway
-    hostname: wristcode-gateway
-    domainname: wristcode.gbrown.org
-    networks: ['nginx-bridge']
     env_file: [.env]
-    environment:
-      - TZ=America/New_York
-    # The image runs as `bun` (uid 1000). keep-id maps it to gib, so ./data stays gib-owned (AGENTS.md §3.2).
-    userns_mode: "keep-id:uid=1000,gid=1000"
+    ports:
+      - "127.0.0.1:8080:8080"   # for a proxy on the same machine. Drop it if the proxy shares a network.
     volumes:
-      - ./data:/data:z        # lowercase :z survives update-containers recreates, as in Agentchat
+      - ./data:/data            # the image runs as uid 1000, which must be able to write here
     restart: unless-stopped
     healthcheck:
       test: wget -qO- http://127.0.0.1:8080/v1/health || exit 1