docs: apply the closed Gitea decisions 3, 19, 20 and 38

- Issue 3 (Q4b): the registered-device cookie stays; no device certificate.
- Issue 19 (Q22): upload limits stay; ClamAV stays off in both stacks,
  the workstations run Microsoft Defender.
- Issue 20 (Q23): the storage alert stays at 85 percent; phase 9 mails
  it to PS-Admins.
- Issue 38 (OPS2): the test stack stays under ~/packetstation/test on
  docker-1. test.env.example, the compose header, README, CLAUDE.md,
  DEPLOY.md and SECURITY.md give that path and the actual modes. The
  production layout is asked on issue 38.

All four confirm the built defaults, so no code changed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/compose.yaml

@@ -5,7 +5,7 @@
 #   docker compose -p packetstation --env-file /etc/packetstation/prod/stack.env \
 #     -f deploy/compose.yaml -f deploy/compose.proxy.yaml up -d
 # Test on docker-1:
-#   docker compose -p packetstation-test --env-file /etc/packetstation/test/stack.env \
+#   docker compose -p packetstation-test --env-file ~/packetstation/test/stack.env \
 #     -f deploy/compose.yaml -f deploy/compose.proxy.yaml up -d
 #
 # No service publishes a port. NPM reaches the app over npm_default (compose.proxy.yaml).

deploy/env/prod.env.example

@@ -79,7 +79,7 @@ ASSETS_QUOTA_WARN_PCT=85
 # 0 measures the assets volume. A byte count measures the stored files against that many bytes.
 ASSETS_QUOTA_BYTES=0
 
-# ---- ClamAV (optional virus scan of uploads) ----
+# ---- ClamAV (optional virus scan of uploads; left off by IT, Gitea issue 19) ----
 # Empty means no scan. When set, start the stack with --profile clamav on every docker compose command.
 # An unreachable scanner then refuses uploads until it answers.
 #CLAMAV_HOST=packetstation-clamav

deploy/env/test.env.example

@@ -1,6 +1,6 @@
-# Packet Station test stack settings. Copy to /etc/packetstation/test/stack.env
-# (root:root 0644). It holds no secret: passwords live in SECRETS_DIR as files.
-# Start: docker compose -p packetstation-test --env-file /etc/packetstation/test/stack.env \
+# Packet Station test stack settings. Copy to ~/packetstation/test/stack.env on docker-1
+# (Gitea issue 38). It holds no secret: passwords live in SECRETS_DIR as files.
+# Start: docker compose -p packetstation-test --env-file ~/packetstation/test/stack.env \
 #          -f deploy/compose.yaml -f deploy/compose.proxy.yaml up -d
 # The test stack never points at VISUAL production.
 # Comments sit on their own lines. Do not put a comment after a value.
@@ -9,17 +9,17 @@
 # Compose project name. Keeps prod and test volumes apart.
 PROJECT_NAME=packetstation-test
 # This file's own path. Compose hands it to the containers as env_file.
-ENV_FILE=/etc/packetstation/test/stack.env
+ENV_FILE=/home/spencerm/packetstation/test/stack.env
 # Image to run. Always a tested release tag, never latest.
 IMAGE=gt.pescoinc.biz/spencerm/packetstation:vX.Y.Z
 # App alias on npm_default. NPM forwards to http://<alias>:8000.
 APP_ALIAS=packetstation-test-app
-# Host folder of secret files, root:10001 mode 0440.
-SECRETS_DIR=/etc/packetstation/test/secrets
+# Host folder of secret files. Readable by uid 10001; the folders above it are 0750.
+SECRETS_DIR=/home/spencerm/packetstation/test/secrets
 # Host PEM file with the PESCO CA chain. Mounted at /etc/ssl/pesco/ca.pem.
-CA_BUNDLE_FILE=/etc/packetstation/ca/pesco-ca.pem
+CA_BUNDLE_FILE=/home/spencerm/packetstation/test/ca/pesco-ca.pem
 # Host backup folder, mounted read-only in the worker. Compose sets BACKUP_DIR=/backups inside.
-BACKUP_DIR=/var/backups/packetstation/packetstation-test
+BACKUP_DIR=/home/spencerm/packetstation/test/backups
 
 # ---- Stack and site ----
 # prod, test, ci or dev. Guards against crossing stacks.
@@ -79,7 +79,7 @@ ASSETS_QUOTA_WARN_PCT=85
 # 0 measures the assets volume. A byte count measures the stored files against that many bytes.
 ASSETS_QUOTA_BYTES=0
 
-# ---- ClamAV (optional virus scan of uploads) ----
+# ---- ClamAV (optional virus scan of uploads; left off by IT, Gitea issue 19) ----
 # Empty means no scan. When set, start the stack with --profile clamav on every docker compose command.
 # An unreachable scanner then refuses uploads until it answers.
 #CLAMAV_HOST=packetstation-clamav