docs: record quadlet standardization of dankserver media + dankclaw data roots

Phase 1/2 of the podman standardization plan: service pages updated to the
quadlet reality (units, Containers data roots, env-file secret convention,
the v1-generator findings each caught live), Storage Policy documents the
two rootless ownership regimes and the merge-move migration, Deployment
Flow's service-manager table no longer claims dankserver media is bare
inventory-only. Bundle change log entry added.

serverAppConfigs-docs/Dankserver/Copyparty.md

@@ -80,7 +80,7 @@ takes its volume roots from argv plus `chdir: /w` in `/z/initcfg`, not from a
 rw on disk — copyparty enforces read-only at the application layer, so local
 services (Jellyfin, Calibre) keep writing into the array directly.
 
-## Docker Compose
+## Docker Compose (reference — retired 2026-09-01; live deployment is the quadlet unit below)
 
 ```yaml
   copyparty:
@@ -100,20 +100,28 @@ services (Jellyfin, Calibre) keep writing into the array directly.
       retries: 3
 ```
 
-`${COPAY_PASS}` is compose-time interpolation from `dankserver/.env` — the
-password lands in the container's **argv**, visible to anyone who can run
+`${COPAY_ACCOUNT}`/`${COPAY_PASSWORD}` are **never** written into the unit:
+they live in the host-local `/home/dank/Containers/copyparty/env` (0600),
+loaded via `[Service] EnvironmentFile=` so systemd expands them into
+`Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD}` at start. The password still
+lands in the container argv — visible to anyone who can run
 `podman inspect copyparty` on the host.
 
-**Applying changes:** `scripts/deploy.sh` deliberately does not touch the
-dankserver compose stack (host containers are not quadlet-managed there), so
-`command:` edits need a manual recreate on Dankserver:
+## Deployment (Quadlet)
 
-```
-cd /home/dank/serverAppConfigs/dankserver && podman-compose up -d --force-recreate copyparty
-```
+Since 2026-09-01: `dankserver/copyparty/quadlet/copyparty.container` →
+`copyparty.service`, deployed with
+`./scripts/deploy.sh dankserver --service copyparty`. Cutover details:
 
-Same project (`dankserver`), only copyparty is recreated; a fresh container
-answers `000` for the first seconds while it mounts.
+- v1 generator rejects `Command=` → the argv lives in `Exec=`.
+- No `HealthCmd=` — the v1 generator splits unquoted spaces in that key;
+  self-healing is `Restart=always`.
+- `PublishPort=3923:3923` — the first cutover dropped it (unit joined
+  `dankserver_appnet`), copyparty answered inside the netns only; the
+  published-port seam test now pins 3923 alongside 8085/8096/8083.
+- Config root moved `/opt/copyparty` → `/home/dank/Containers/copyparty/cfg`.
+- The deployer refuses to start the unit before the env file exists, so a
+  missing seed cannot create an admin account with a garbage password.
 
 ## Healthcheck