feat: harden authenticated deployment

README.md

@@ -32,7 +32,21 @@ The public landing page is at `/`; plans require an account at `/app`. Productio
 
 ### First administrator
 
-Generate `BOOTSTRAP_SETUP_TOKEN` with `openssl rand -base64 48`, keep it only in the deployment environment, then call `POST /api/auth/bootstrap` with that token, `[email protected]`, and a 12+ character password. The endpoint can create that account only once. Remove the setup token after success; no administrator password is stored in source control.
+Generate `BOOTSTRAP_SETUP_TOKEN` with `openssl rand -base64 48`, keep it only in the deployment environment, then call `POST /api/auth/bootstrap` with that token, `[email protected]`, and a 12+ character password. The endpoint can create that account only once. Remove the setup token after success; it is optional thereafter and no administrator password is stored in source control.
+
+### Pi agent configuration in Docker
+
+The `app` service mounts `PI_AGENT_CONFIG_DIR` (default `./appdata/pi-agent`) read-only at `/home/node/.pi/agent`, the non-root Node user's Pi configuration directory. This lets `/api/prefill` use the same configured model at runtime without baking credentials into the image. The directory is ignored by Git and Docker build context; do not commit its contents.
+
+Before bringing up the stack, sync only the local Pi agent configuration you intend to make available to the container:
+
+```bash
+mkdir -p appdata/pi-agent
+rsync -a --delete ~/.pi/agent/ appdata/pi-agent/
+docker compose --env-file .env up --build
+```
+
+Set `PI_AGENT_CONFIG_DIR` to another protected host directory instead if preferred. Restrict access to that directory because it can contain provider credentials. The mount is read-only, so Pi cannot alter the host configuration. If deployed behind a reverse proxy, set `TRUST_PROXY` only to that proxy's specific IP/CIDR (or keep it blank when the app is directly exposed).
 
 ## Mobile and PWA use
 
@@ -61,8 +75,7 @@ If those tables change in the paper worksheet, port the change here too.
 
 ## Known gaps (v1)
 
-- No automated test suite yet (the ledger math and `.alog` parser were verified manually
-  against the worksheet's worked examples and all 14 logs in `ref/roasts/`, respectively).
+- Offline drafts are intentionally scoped to the authenticated browser account and are cleared on logout; account-backed plans remain the authoritative copy.
 - Roastetta (roastetta.com) integration is intentionally out of scope — it needs a headed,
   Cloudflare-clearing browser and the operator's own credentials. Use the `.alog` file picker,
   or point `ALOG_DIR` at wherever the `roastetta` skill already downloaded files.