Upgrade guide (fresh database, config changes that fail startup), nginx and Caddy reverse proxy examples with X-Real-IP and trusted_proxies, a fixed compose subnet, and the API contract and design doc brought up to date.
