feat(delivery): phase 12 — the container, and the defect only a proxy could find

PLAN.md §13 phase 12, the last one. Four decisions of record, D54–D57, taking the
count to fifty-seven; recorded in §6, "How phase 12 delivered it".

A two-stage Dockerfile, a pull-only docker-compose.yml carrying both bind mounts,
.env.example, the workflow that publishes and deploys, CONTRIBUTING.md, the
community-health files this was the only repository of the ten to lack, and
DEPLOY.md.

D54 — a merge deploys, amending D6. build-image.yml pushes
runicgateway-site:latest and :sha-<7>, then rolls the container over on the
`rgcom` runner out of /opt/runicgateway.com, and waits for the container's own
healthcheck rather than for `up -d` to return.

D55 — the site runs on its own host behind a generic reverse proxy, so DEPLOY.md
states the four requirements rather than one worked example, and the container
binds 127.0.0.1 so the safe configuration is the default.

D56 — @astrojs/node derives the request protocol from req.socket.encrypted and
never reads x-forwarded-proto, so behind a TLS-terminating proxy the browser sends
Origin: https://… while the container computes http://… and Astro's CSRF check
compares them for equality. Every beta signup, from every visitor, was answered
403. serve.mjs now normalises both forwarded headers, unconditionally — the image
should deploy and work. Two assertions in test/headers.test.mjs hold both halves.

D57 — DEPLOY.md rather than a README section; SECURITY.md and CODE_OF_CONDUCT.md
are pointers to the org's copies rather than copies, because a copy would hard-code
the contact address D13 confines to brand.json.

Verified: npm run verify green (eleven checks, 36 unit tests, 7 served tests,
astro check 0 errors). The image was built and run with both mounts — a mounted
brand reached 51 files and all 50 search pages, /brand/* fell back per file, a
proxy-shaped signup reached the store, and the export CLI wrote both Play files to
the host mount. docker compose config caught a YAML trap in the healthcheck: a
block sequence reads the `: ` in `r.ok ? 0 : 1` as a mapping.

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -11,11 +11,12 @@ closed beta: **players**, who want the app.
 platform state, the org lead's decisions, the information architecture, and the build phases. Read
 it before changing anything here.
 
-**Status: phase 5 of 12 — the app and the beta.** The foundation, the branding pipeline, the
-homepage and the five marketing pages are built, and `/app/` and `/beta/` now join them: a signed
-APK beside the closed-test signup, backed by a SQLite store on a bind mount and an export CLI. Next
-are the legal pages (phase 6) and then the documentation — the installation path, which is the
-priority of the whole project — in phases 7 and 8.
+**Status: phase 12 of 12 — delivery. The site is built.** Fifty pages: ten marketing, legal and
+app pages and forty of documentation, with real screenshots of the product, full-text search, a
+per-page Content-Security-Policy, eleven checks that fail the build when the platform moves out from
+under a claim, and a closed-beta signup backed by SQLite on a bind mount. This phase is the part
+that makes it a deployment rather than a repository — the container image, the compose file, the
+publishing workflow and [`DEPLOY.md`](DEPLOY.md).
 
 ---
 
@@ -31,7 +32,22 @@ npm run build        # → dist/  (prerendered pages + the Node server entry)
 npm start            # serve the built site
 ```
 
-Node 22 LTS or newer.
+Node 22 LTS or newer. Nothing else — no database, no game server, no container runtime.
+
+## Running it in production
+
+One container, pulled from the Gitea registry, with two bind mounts and a reverse proxy in front.
+**[`DEPLOY.md`](DEPLOY.md) is the operator's guide**: first deploy, what the proxy must and must not
+do, DNS and TLS, branding without a rebuild, managing the tester list, rolling back, and the
+symptoms table.
+
+```bash
+docker compose pull && docker compose up -d
+```
+
+Merging to `main` builds the image, publishes it as `runicgateway-site:latest` and `:sha-<7>`, and
+deploys it — `.gitea/workflows/build-image.yml`. There is no separate release step, so **a merge is
+a publication**.
 
 ## The checks, and why they are not optional
 
@@ -234,6 +250,10 @@ scripts/                 The build-time checks, plus applyBrand and serve (boot)
 test/                    node --test. The logic the other checks cannot see.
 PLAY_DATA_SAFETY.md      GENERATED. The answers to Google Play's Data Safety form, from
                          src/data/collection.mjs. Edit the data, run npm run play:datasafety.
+Dockerfile               Two stages. Build with the toolchain, run with the pruned tree.
+docker-compose.yml       Production. Pull-only, one service, both bind mounts.
+.env.example             The two secrets worth setting, and every default made visible.
+DEPLOY.md                The operator's guide: proxy, DNS, TLS, branding, backups.
 ```
 
 Two directories are bind mounts at runtime and are **not** in the repository: `brand/` overrides
@@ -244,13 +264,18 @@ and §7.
 
 Branch from `main` (`feature/…`, `fix/…`, `docs/…`, `chore/…`) and use
 [Conventional Commits](https://www.conventionalcommits.org/). Run `npm run verify` before opening a
-pull request.
+pull request. **[CONTRIBUTING.md](CONTRIBUTING.md)** has the rest, including the two rules from
+`PLAN.md` that constrain how a page may be written at all: the site never re-specifies a contract,
+and no fact is stated in prose.
 
 **AI-assisted contributions must be disclosed**, per org policy: tick the box in the pull request
 template naming the tool, and mark AI-authored commits with a trailer such as
 `Co-Authored-By: Claude <noreply@anthropic.com>`. Undisclosed AI-generated contributions may be
 closed.
 
+Security problems go to [SECURITY.md](SECURITY.md), never to a public issue. Everyone taking part is
+covered by the [Code of Conduct](CODE_OF_CONDUCT.md).
+
 ## Licence
 
 GPL-3.0-or-later, in common with every repository in the organisation. See [LICENSE](LICENSE).