docs: migrate Authentik (SSO keystone) to edge2 CT 105

- Authentik -> edge2 CT 105 (Postgres pg_dump/restore; SECRET_KEY carried verbatim; zero-downtime until ~2s cutover)
- Multi-block Caddy cutover: auth.echo6.co + notes.echo6.co outpost/forward_auth -> 100.64.0.36:9000
- runbook: add reboot tailscale-before-docker gotcha; clarify dnsmasq must NOT be repointed (points at Caddy host)
- source left stopped + intact on Contabo as cold rollback

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/navi/deployment.md

@@ -1,55 +0,0 @@
-# Navi Deployment
-
-## Source Repository
-
-**Location:** VM 1130 (`192.168.1.130`) at `/home/zvx/projects/repos/navi`
-
-> **WARNING:** Never deploy from `/home/zvx/projects/navi-work` on cortex — that clone is stale.
-
-## Build & Deploy
-
-```bash
-# SSH to VM 1130
-ssh recon-vm
-
-# Always backup first
-cp -r /mnt/nav/frontend /mnt/nav/frontend.bak.$(date +%Y%m%d-%H%M%S)
-
-# Build and deploy
-cd /home/zvx/projects/repos/navi
-npm run build && rsync -av --delete dist/ /mnt/nav/frontend/
-```
-
-## Infrastructure
-
-- **Nginx** on VM 1130 serves `/mnt/nav/frontend/` on port 8440
-  - `index.html`: no-cache (always fresh)
-  - Hashed assets (`*.js`, `*.css`): cache forever
-- **Caddy** on CT 101 routes `navi.echo6.co` → VM 1130:8440
-
-## Pre-Deploy Checklist
-
-1. Merge feature branch to master before deploying
-2. Check for unmerged upstream commits:
-   ```bash
-   git log your-branch..master --oneline
-   ```
-3. Create backup (see above)
-
-## Post-Deploy Smoke Tests
-
-Run after **every** deploy:
-
-- [ ] Route between two addresses — polyline renders
-- [ ] Click city label — boundary outline appears
-- [ ] Theme switching works (dark, light, clean, cyberpunk)
-- [ ] Toggle overlays (hillshade, contours, public lands)
-- [ ] Console: no `bt is not defined` or `f is not defined` errors
-
-## Rollback
-
-```bash
-# If deploy fails, restore backup
-rm -rf /mnt/nav/frontend
-mv /mnt/nav/frontend.bak.YYYYMMDD-HHMMSS /mnt/nav/frontend
-```