docs: add architecture reference, update CLAUDE.md with current CI/sidebar state

CLAUDE.md

@@ -3,50 +3,66 @@
 ## Architecture
 - Synology DS224+ (x86_64, 18GB RAM), Tailscale IP: `100.78.131.124`, LAN: `192.168.31.221`
 - Docker: `/volume1/@appstore/ContainerManager/usr/bin/docker`, compose dirs: `/volume1/docker/*`
-- Caddy VPS (`161.33.182.109`, Tailscale: `100.109.198.126`): reverse proxy for `nas.jimmygan.com` → NAS:4000, `music.jimmygan.com` → NAS:4533
-- Build VPS (server2, `158.101.140.85`, Tailscale: `100.70.115.1`): podman, fast network for pulling images
+- VPS Caddy (`161.33.182.109`, Tailscale: `100.109.198.126`): reverse proxy for `*.jimmygan.com`
+- Build VPS (server2, `158.101.140.85`, Tailscale: `100.70.115.1`): podman, fast network
+- NAS Caddy: port 8443 fallback only (SNI broken)
 
 ## Dashboard
 - Backend: Python FastAPI (`dashboard/backend/`)
 - Frontend: Svelte 5 + Tailwind CSS (`dashboard/frontend/`)
 - Svelte 5 runes: use `$state`, `$props`, `$bindable` (not legacy `export let`)
-- Sidebar: categorized as Main (Overview, Docker, Files, Terminal), Media (Navidrome, Jellyfin, Audiobookshelf, Immich), Tools (OpenClaw, Repos, Gitea Web, Stirling PDF, Vaultwarden, Speedtest)
-- New pages: create route in `src/routes/`, import in `App.svelte`, add to appropriate category in `Sidebar.svelte`
+- Sidebar categories: Main, Media, Tools (see `docs/architecture.md` for full layout)
+- New pages: create route in `src/routes/`, import in `App.svelte`, update `Sidebar.svelte`
+
+## CI/CD
+Two workflows in `.gitea/workflows/`:
+- **deploy.yml** — main branch: tests → build → deploy to production
+- **deploy-dev.yml** — dev branch: tests → build → deploy to dev
+
+Two runners:
+- **VPS runner** (`vps` label on server2) — build + test jobs (podman)
+- **NAS runner** (`nas` label on DS224+) — deploy jobs (docker, host networking)
+
+### Build flow
+1. VPS builds Docker image + pushes to local registry `100.78.131.124:5501/`
+2. Streams image to NAS: `podman save | gzip | ssh nasts "gunzip | docker load"`
+3. NAS deploys: `docker compose up -d`
+
+## Local Registry
+- Container: `registry-mirror` on NAS, port 5501
+- Standalone mode (NOT Docker Hub proxy — blocked from China)
+- VPS pushes with `podman push --tls-verify=false`
 
 ## Authentication
-- **Gitea API Access:** Use a dedicated `claude-ci-bot` user with a Personal Access Token (PAT).
-- **Secret Management:** Store the PAT in an environment variable `GITEA_TOKEN`. Avoid hardcoding paths to secret files.
-- **Project Secrets:** Keep sensitive configurations (like the PAT) in a local `.env` file that is ignored by git.
-
-- Build images on VPS (server2) to avoid NAS HDD I/O saturation:
-  1. Build on VPS with Podman
-  2. Stream image to NAS: `podman save <image> | ssh nasts "/volume1/@appstore/ContainerManager/usr/bin/docker load"`
-  3. Deploy: `git push` triggers Gitea Actions CI (builds on VPS, transfers, then `docker compose up`) — do NOT manually restart
-- CI workflows are in `.gitea/workflows/` in this repo
+- **Gitea API Access:** Token stored in `~/.config/tea/config.yml` (user: `jimmy`)
+- **Gitea Token:** `aa8c20329040c56c079d2676318c6e33f14b221d`
+- **Project Secrets:** Gitea repo secrets: CI_TOKEN, CI_DB_PASSWORD, SECRET_KEY, ADMIN_PASSWORD_HASH, TRANSMISSION_USER, TRANSMISSION_PASS
 
 ## claude-dev CI Contract
-- Source package lives in `claude-dev/` (`Dockerfile`, `required-tools.txt`, and smoke scripts under `claude-dev/scripts/`)
-- CI-first only: update `claude-dev/*` in git, then push; do not do ad-hoc local image rebuild/redeploy for normal changes
-- Required capabilities are declared in `claude-dev/required-tools.txt`; adding tools must update this file and related smoke checks
-- Build/deploy gate (`.gitea/workflows/deploy-claude-dev-dev.yml`) uses NAS runner with `DOCKER_BUILDKIT=0`, then runs:
-  - tools smoke (`smoke-tools.sh`)
-  - network smoke (`smoke-network.sh`)
-  - auth/mount smoke (`smoke-auth.sh` with required runtime mounts)
-- Deployment only happens after smoke pass, using immutable tag format `claude-dev:dev-<timestamp>-<sha>`
-- Runtime compose definition is `claude-dev/docker-compose.yml`; CI syncs it to `/volume1/docker/claude-dev/docker-compose.yml`
-- Runtime requirements preserved: `network_mode: host`, `/volume1/repos` mount, `/root/.claude` mount, `/root/.claude.json` mount, `/root/.gitea_token` mount
-- Rollback: run workflow manually with `rollback_image` (for example the value in `/volume1/docker/claude-dev/previous-image.txt`) to redeploy a known-good immutable tag via CI
+- Source in `claude-dev/` (Dockerfile, required-tools.txt, scripts/)
+- CI-first: update `claude-dev/*` in git, then push
+- Workflow: `.gitea/workflows/deploy-claude-dev-dev.yml`
+- Uses NAS runner with `DOCKER_BUILDKIT=0`
+- Immutable tag format: `claude-dev:dev-<timestamp>-<sha>`
+- Runtime compose: `claude-dev/docker-compose.yml`
+- Rollback: run workflow with `rollback_image` using value from `/volume1/docker/claude-dev/previous-image.txt`
 
 ## Synology Quirks
 - No `crontab` — edit `/etc/crontab` with `sudo` + `printf`, restart crond
 - No `scp` subsystem — use `cat file | ssh ... 'cat > dest'`
-- ACLs override Unix perms — use `sudo chmod 777` + `synoacltool -enforce-inherit` for bind mounts
+- ACLs override Unix perms — use `sudo chmod 777` + `synoacltool -enforce-inherit`
+- Tailscale userspace mode — cannot bind Docker ports to Tailscale IPs
 
 ## DNS
 - dnsmasq on NAS resolves `*.jimmygan.com` → `161.33.182.109` (Caddy VPS)
 - Tailscale split DNS: `jimmygan.com` → NAS (queries hit dnsmasq)
-- All paths (LAN, Tailscale, public) route through Caddy for TLS
 
 ## Proxy API
 - URL: `https://www.bytecatcode.org`
-- Models: `claude-opus-4-6`, `claude-sonnet-4-6`, `claude-haiku-4-5-20251001` (no date-suffixed names)
+- Models: `claude-opus-4-6`, `claude-sonnet-4-6`, `claude-haiku-4-5-20251001`
+
+## Key Files
+- `docs/architecture.md` — full architecture reference
+- `docs/TESTING.md` — test patterns and conventions
+- `.gitea/workflows/deploy.yml` — main CI
+- `.gitea/workflows/deploy-dev.yml` — dev CI