Docs: public README, setup guide and architecture, generic deploy files, and the T3 Code notice

docs/api.md

@@ -4,7 +4,7 @@ The watch app talks to the gateway over HTTPS with JSON bodies. The TypeScript t
 [`gateway/src/contract.ts`](../gateway/src/contract.ts) are the source of truth, and the watch
 mirrors them in `watch/WristCode/API/Models.swift`. Change both together.
 
-The base URL is `https://wristcode.gbrown.org`. Every route except `GET /v1/health` and
+The base URL is your gateway's public HTTPS address, such as `https://wristcode.example.com`. Every route except `GET /v1/health` and
 `POST /v1/pair` needs `Authorization: Bearer <deviceToken>`. Timestamps are ISO 8601 strings in UTC.
 
 Errors return a non-2xx status with `{ "error": "<message for a person>" }`.
@@ -330,11 +330,11 @@ GET /v1/status
 
 HostStatusDetail {
   "id": "...", "label": "Laptop", "status": "online", "error": null,
-  "activeUrl": "http://laptopvpn.gib:3773",
+  "activeUrl": "http://laptop-vpn.lan:3773",
   "routes": [
-    { "url": "http://laptop.gib:3773", "kind": "direct", "result": "failed", "error": "no answer in 5 s", "checkedAt": "..." },
-    { "url": "http://laptopvpn.gib:3773", "kind": "vpn", "result": "ok", "error": null, "checkedAt": "..." },
-    { "url": "https://t3laptop.gbrown.org", "kind": "public", "result": "untried", "error": null, "checkedAt": null }
+    { "url": "http://laptop.lan:3773", "kind": "direct", "result": "failed", "error": "no answer in 5 s", "checkedAt": "..." },
+    { "url": "http://laptop-vpn.lan:3773", "kind": "vpn", "result": "ok", "error": null, "checkedAt": "..." },
+    { "url": "https://t3-laptop.example.com", "kind": "public", "result": "untried", "error": null, "checkedAt": null }
   ],
   "onlineSince": "...", "lastOnlineAt": null, "nextRetryAt": null,
   "tokenExpiresAt": "2026-12-01T00:00:00.000Z", "serverVersion": "0.1.5"