release: prepare production client deployment

deploy/production/README.md

@@ -0,0 +1,30 @@
+# Production deployment
+
+These files are the non-secret, host-specific deployment manifests for the
+initial x1/x2/lithium topology.
+
+- Install the x1 and x2 files as
+  `~/compose/ArchiveControl-cache/{compose.yaml,client.toml}`.
+- Install the lithium files as
+  `~/compose/ArchiveControl-archive/{compose.yaml,client.toml}`.
+- Create sibling `state`, `backups`, and `secrets` directories owned by the
+  configured container UID/GID.
+- Secret files are never committed. Each `secrets` directory contains
+  `archive_control_token`, `qb_password`, and `syncthing_api_key`, each a
+  regular non-empty file with mode `0600`.
+
+The Syncthing mounts intentionally reproduce each instance's `/var/syncthing`
+layout, including nested data binds. This lets route discovery and route
+provisioning use one safe API-to-local path mapping without altering an
+existing Syncthing configuration.
+
+Before starting a stack, validate it with:
+
+```sh
+docker compose config
+docker compose run --rm archive-client --check-config
+```
+
+The check is fail-fast and performs local permission, filesystem, sparse-file,
+hard-link, and reflink probes. Normal startup additionally probes the local
+qBittorrent and Syncthing APIs before registration.