docs: apply the closed Gitea decisions 3, 19, 20 and 38

- Issue 3 (Q4b): the registered-device cookie stays; no device certificate.
- Issue 19 (Q22): upload limits stay; ClamAV stays off in both stacks,
  the workstations run Microsoft Defender.
- Issue 20 (Q23): the storage alert stays at 85 percent; phase 9 mails
  it to PS-Admins.
- Issue 38 (OPS2): the test stack stays under ~/packetstation/test on
  docker-1. test.env.example, the compose header, README, CLAUDE.md,
  DEPLOY.md and SECURITY.md give that path and the actual modes. The
  production layout is asked on issue 38.

All four confirm the built defaults, so no code changed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/compose.yaml

@@ -5,7 +5,7 @@
 #   docker compose -p packetstation --env-file /etc/packetstation/prod/stack.env \
 #     -f deploy/compose.yaml -f deploy/compose.proxy.yaml up -d
 # Test on docker-1:
-#   docker compose -p packetstation-test --env-file /etc/packetstation/test/stack.env \
+#   docker compose -p packetstation-test --env-file ~/packetstation/test/stack.env \
 #     -f deploy/compose.yaml -f deploy/compose.proxy.yaml up -d
 #
 # No service publishes a port. NPM reaches the app over npm_default (compose.proxy.yaml).