fix(deploy): reuse shared redis and serve dashboard at root

docs/ops/01-rolling-upgrade.md

@@ -10,9 +10,9 @@ Production web and worker processes never migrate on startup. The Compose file
 also requires `GOCHAT_IMAGE_REF` to be an immutable `image@sha256:digest`; tags such
 as `latest` are not an acceptable rollback record.
 
-The bundled `gochat_storage` volume is shared and durable for replicas on one
-Docker host. Multi-host replicas must provision that volume with a shared
-volume driver/filesystem; never use separate node-local volumes.
+Persistent files live under `deploy/docker/data/` beside the production Compose
+file. Multi-host replicas must mount shared storage at that path; never use
+separate node-local attachment directories.
 
 ## Recovery objectives
 
@@ -40,7 +40,7 @@ export GOCHAT_CONNECTOR_BACKUP_NAME="connector-$(date -u +%Y%m%dT%H%M%SZ).db"
 ```
 
 Backup/restore are audited one-shot containers and run as root only to read or
-rebuild Docker volumes; web and worker remain non-root.
+rebuild bind-mounted data directories; web and worker remain non-root.
 For an external database using certificate files, keep the three DSN paths
 fixed as documented in `.env.example`. Set the host files' group to
 `GOCHAT_DATABASE_TLS_GID` and grant that group read permission (`0640` for the
@@ -67,7 +67,8 @@ off-site copy exits non-zero and must alert.
 
 ## Clean-environment restore rehearsal
 
-Use an isolated host/project with empty volumes and an empty PostgreSQL database.
+Use an isolated host/project with an empty `deploy/docker/data/` directory and
+an empty PostgreSQL database.
 Do not point this procedure at the live project.
 
 ```bash

docs/ops/02-production-operations.md

@@ -5,10 +5,10 @@ All commands run from the repository root. Set `COMPOSE='docker compose -f deplo
 ## Install and preflight
 
 - **Owner:** release engineer; SRE on-call approves the target host.
-- **Prerequisites:** Docker Compose 2.26+, immutable GoChat/Connector digests, external backup mount, untracked backup passphrase and Alertmanager HTTPS webhook files. For external PostgreSQL, set one complete `GOCHAT_DATABASE_DSN` with exactly one `sslmode=verify-ca|verify-full`. When using a private CA or client certificate, keep the DSN paths fixed at `/run/secrets/external-db-ca.crt`, `/run/secrets/external-db-client.crt`, and `/run/secrets/external-db-client.key`; set the three corresponding untracked host-file variables plus `GOCHAT_DATABASE_TLS_GID`, assign that group to the files, and grant group read permission (`0640` for the key). Compose mounts the files read-only and adds the group to every database client.
+- **Prerequisites:** Docker Compose 2.26+, immutable GoChat/Connector digests, external backup mount, untracked backup passphrase and Alertmanager HTTPS webhook files. Create the required `deploy/docker/data/` subdirectories before startup. For external PostgreSQL, set one complete `GOCHAT_DATABASE_DSN` with exactly one `sslmode`: use `disable` only on a trusted private network, or use `verify-ca`/`verify-full` for TLS. Redis may use unauthenticated `redis://` only on a trusted private Docker network; use authenticated `rediss://` when traffic crosses an untrusted network. When PostgreSQL uses a private CA or client certificate, keep the DSN paths fixed at `/run/secrets/external-db-ca.crt`, `/run/secrets/external-db-client.crt`, and `/run/secrets/external-db-client.key`; set the three corresponding untracked host-file variables plus `GOCHAT_DATABASE_TLS_GID`, assign that group to the files, and grant group read permission (`0640` for the key). Compose mounts the files read-only and adds the group to every database client.
 - **Commands:** `deploy/docker/preflight.sh .env`; then `$COMPOSE config --quiet`; then `$COMPOSE --profile ops run --rm migrate`; finally `$COMPOSE up -d --wait`.
 - **Success / failure:** success means preflight exits 0, every non-profile service is healthy/running, and rendered `gochat`, `migrate`, `backup`, `restore`, and `postgres-exporter` configuration uses the same database DSN; any mutable image, missing secret file, DSN mismatch, migration error, or unhealthy service is failure.
-- **Rollback:** `$COMPOSE down` leaves named data volumes intact; if migration ran, follow `01-rolling-upgrade.md` and restore the preflight backup instead of running schema down.
+- **Rollback:** `$COMPOSE down` leaves `deploy/docker/data/` intact; if migration ran, follow `01-rolling-upgrade.md` and restore the preflight backup instead of running schema down.
 - **Drill cadence:** before every release and quarterly on a clean host.
 
 ## TLS and reverse proxy