cleanup phase 1

server/docker-compose.yml

@@ -5,11 +5,15 @@
 # seeds roles + an admin user + a sandbox gateway against this empty instance.
 #
 # The SA password below is a well-known DEV-ONLY value: it is NOT a secret, is used only on localhost,
-# and never reaches a deployed environment. Point the API at this instance via `dotnet user-secrets`
-# (see dev/post-phase/refinement/RUNBOOK.md) — never by editing a committed appsettings*.json.
+# and never reaches a deployed environment.
+#
+# Point the API at this instance by setting `ConnectionStrings:SqlServer` in
+# `src/API/Baya.Web.Api/appsettings.Development.json` (or as an environment variable).
+# `dotnet user-secrets` is NOT used in this repo — the `<UserSecretsId>` was removed, so that store is
+# never read. See docs/rules/shared/code-quality.md §6 for the configuration model.
 #
 #   docker compose up -d
-#   # then set ConnectionStrings:SqlServer via user-secrets (see the runbook), then `dotnet run`
+#   # then set ConnectionStrings:SqlServer as above, then `dotnet run`
 #
 # The API itself runs on the host via `dotnet run` (not in a container) for the local-dev loop — this
 # compose file intentionally provisions only the database.