Document governed deployment path

CLAUDE.md

@@ -22,6 +22,8 @@ Frontend (Tailwind + vanilla JS) → FastAPI backend → LLM (Claude/OpenAI/Olla
 - **Auth:** Jellyfin credentials (like Jellyseerr) — no separate user database
 - **Data:** SQLite cache of movie metadata synced from Jellyfin, persisted at /data/library.db
 - **Deployment:** Docker Compose on bondelie-media (192.168.5.254), port 5210
+- **Deployment policy:** See `DEPLOYMENT.md`; infrastructure adoption is
+  transitional and production still builds locally for now.
 
 ## Key Files
 
@@ -76,9 +78,8 @@ uvicorn app.main:app --reload --port 5210
 # Docker build and run
 docker compose up --build
 
-# Deploy to bondelie-media
+# Production deployment
-scp -r . kenny@192.168.5.254:/srv/stacks/movie-night/
+# Follow DEPLOYMENT.md. Do not deploy directly from an uncommitted worktree.
-ssh kenny@192.168.5.254 "cd /srv/stacks/movie-night && docker compose up --build -d"
 ```
 
 ## Environment Variables

DEPLOYMENT.md

@@ -0,0 +1,33 @@
+# Deployment ownership
+
+Movie Night application code belongs to this repository. Its production
+deployment definition is governed by the private Gitea repository
+`kbondelie/server-infrastructure`, currently referenced as the submodule
+`stacks/bondelie-media/movie-night`.
+
+## Current transitional path
+
+Production on `bondelie-media` still builds this repository's Dockerfile
+locally. Until the registry pipeline is implemented:
+
+1. Commit and push application changes here.
+2. Advance the Movie Night submodule pointer in `server-infrastructure`.
+3. Review and merge that infrastructure change.
+4. Synchronize only the declared application source to the host and run the
+   documented manual Compose build/deployment.
+5. Verify the HTTP endpoint and container health.
+
+Do not make production-only source edits. The host `.env` and SQLite data are
+runtime state and must never be committed.
+
+## Intended path
+
+After Renovate is operational, Gitea Actions will test this repository and
+publish semantic-version images to the private Gitea OCI registry. Production
+Compose will change from `build: .` to a pinned
+`version@sha256:registry-digest` image in `server-infrastructure`. Renovate
+will propose releases there; a human merge and Ansible deployment will remain
+the production gates.
+
+The active sequencing and safety requirements live in
+`server-infrastructure/docs/implementation-plan.md`.