add docker-compose swarm stack (traefik, NFS binds); SPEC/AGENTS docs

AGENTS.md

@@ -22,10 +22,11 @@ Project conventions and operational gotchas for agents working in this repo.
 - Sanity-import: `./venv/bin/python -c "from app import main; print('IMPORT_OK')"`.
 
 ## Docker
-- `docker build -t idrs-api .`
-- Run with volumes: `-v idrs-data:/app/data -v idrs-icons:/app/app/static/icons`, env via `--env-file .env`.
+- `docker build -t idrs-api .` → `docker tag idrs-api:latest git.proit.id/proitlab/idrs-api:latest` → `docker push git.proit.id/proitlab/idrs-api:latest` (registry `git.proit.id`, project `proitlab`).
+- Deploy (Swarm): `docker stack deploy -c docker-compose.yml idrs` — service `idrs-api`, traefik labels (Host `idrs.databisnis.id`, `entrypoints=websecure`, `certresolver=letsencrypt`), constraint `node.hostname != server2U`, external overlay `traefik-net` (must pre-exist on manager), `env_file: .env`.
+- NFS bind mounts: `/mnt/nfs/server5.saltis.id/data/idrs/data` → `/app/data` (DB), `/mnt/nfs/server5.saltis.id/data/idrs/static` → `/app/app/static` (icons live at `<static>/icons/`; `icons/` subdir auto-created on first upload).
 - MUST use a single uvicorn worker (in-memory starlette sessions → `--workers >1` breaks login).
-- DB + uploaded icons persist in the volumes across container recreate; code changes need an image rebuild.
+- DB + uploaded icons persist in the volumes across container recreate; code changes need an image rebuild + re-push.
 
 ## Verification
 - curl login: `POST /admin/login` with `-c/-b` cookie jar; then curl admin endpoints / uploads with the jar.