remove user-secrets approach & prepare a pilot deploy

CLAUDE.md

@@ -55,10 +55,17 @@ solution — each project is built, linted, and run on its own.
 | [`server/`](server/) | Backend API | ASP.NET Core (.NET 10) · Clean Architecture · CQRS · EF Core | [server/CLAUDE.md](server/CLAUDE.md) |
 | [`product/`](product/) | Product docs | Markdown | — (see table above) |
 | [`dev/`](dev/) | Build plan (not app code) | Markdown | [dev/README.md](dev/README.md) |
+| [`telegram-otp-bot/`](telegram-otp-bot/) | OTP relay (standalone) | Node 18+, zero deps | [telegram-otp-bot/README.md](telegram-otp-bot/README.md) |
+| [`deploy/`](deploy/) | Reverse-proxy config | Caddyfile | [DEPLOY.md](DEPLOY.md) |
 
 The two communicate over **HTTP/JSON** (optionally gRPC). The client reads the API base URL from
 `NEXT_PUBLIC_API_URL`; the server listens on `https://localhost:5002` by default.
 
+**Deployment** is three Docker containers — one `Dockerfile` per project directory, orchestrated by the
+root [`docker-compose.yml`](docker-compose.yml) — behind an existing Caddy reverse proxy on the external
+`caddy_net` network, serving `balinyaar.ir` (client) and `api.balinyaar.ir` (server). The database is
+**not** containerised; it is a remote SQL Server. Full runbook: [DEPLOY.md](DEPLOY.md).
+
 [`dev/`](dev/README.md) holds the **phased build plan** that takes the repo from its current baseline to
 the MVP: a chain of agent-runnable prompt files split into a `backend/` and a `frontend/` track
 ([dev/phases/](dev/phases/README.md)), the cross-project API [`contracts/`](dev/contracts/README.md), and
@@ -80,8 +87,14 @@ project — there is nothing to build in it.
 5. **Don't reintroduce template/starter scaffolding.** Both projects were derived from open-source
    starters; their branding, demo/showcase pages, and `_TITLE_`/`_DESCRIPTION_` placeholders were
    intentionally removed. Don't add them back.
-6. **Never commit secrets.** Use `.env` (client) and `appsettings.*.json` / user-secrets (server).
-   Real connection strings, keys, and tokens never enter git.
+6. **Configuration lives in files, not in a secret store.** `dotnet user-secrets` is **not** used — the
+   `<UserSecretsId>` was removed from `Baya.Web.Api.csproj`, so that store isn't even read. Server config
+   (including keys) lives in `appsettings.*.json`; client config in `.env.development` / `.env.production`;
+   the deployment's container-specific overrides in `docker-compose.yml`. This is a deliberate pre-launch
+   trade for a demo deployment — **the repo therefore contains live credentials**. Before onboarding real
+   users, rotate them and move the secret half out of git (see [DEPLOY.md](DEPLOY.md) "Going to Production").
+   One value is load-bearing and must never change: `Seams:FieldEncryption:Key`/`:HashKey` decrypt all
+   existing PII and derive the phone-lookup hash.
 7. **Keep docs honest, and keep the architecture map current.** If you change how something works,
    update the `CLAUDE.md` that describes it in the same change. Each level documents its architecture
    in one canonical place — **this file's "Repository layout"** (repo), **client/CLAUDE.md "Project