docs(marreta): record live deploy + the base64: APP_KEY gotcha

Deployed live at 91e9410 (gluetun+marreta+caddy), authentik provider pk 13,
guard chain verified end-to-end. Documented that Laravel APP_KEY must carry the
base64: prefix — a bare base64 key 500s every app route with 'Unsupported
cipher or incorrect key length' while /up still passes.

serverAppConfigs-docs/Dankclaw/Marreta.md

@@ -149,7 +149,7 @@ dank-owned so the rootless unit can read it — the grafana convention, not
 
 | Repo `.env` key | Mapped to (app) | Notes |
 |-----------------|-----------------|-------|
-| `MARRETA_APP_KEY` | `APP_KEY` | Laravel encryption key (`openssl rand -base64 32`). Changing it after first boot invalidates encrypted session/cookie data. |
+| `MARRETA_APP_KEY` | `APP_KEY` | Laravel encryption key. **Must be the `base64:`-prefixed form**: `base64:$(openssl rand -base64 32)`. A bare base64 string (no prefix) is read as a raw key of the wrong length and every app route 500s with `Unsupported cipher or incorrect key length` at `Encrypter.php:61` (only `/up`, which skips the encrypter, still passes). Changing it after first boot invalidates encrypted session/cookie data. |
 | `MARRETA_ADMIN_EMAIL` | `ADMIN_EMAIL` | Admin panel login (created on first boot). |
 | `MARRETA_ADMIN_PASSWORD` | `ADMIN_PASSWORD` | Admin panel password. |
 
@@ -189,6 +189,26 @@ netns down and would otherwise orphan it).
   `curl http://192.168.0.143:8082/up` → 200.
 - **Test seam:** `bats tests/marreta_quadlet.bats` (17 contracts).
 
+### Live verification (deployed 2026-09-12, rev `91e9410`)
+
+Deployed via `deploy.sh dankclaw --service gluetun --service marreta --service
+caddy` (gluetun first to recreate the tunnel with the new `8082:8085` publish,
+which also cycles SearXNG's netns ref). Authentik `ProxyProvider` `marreta`
+registered (pk 13, `external_host=https://marreta.franksdank.cloud/`,
+`internal_host=http://caddy:8017`). Results:
+
+- Unauth edge → Anubis challenge page (not 502). TLS cert issued via DNS-01.
+- Post-auth sim (`caddy :8017` with `Host: marreta.franksdank.cloud`) → **200**.
+- `marreta` container health: **healthy**; `/` and `/admin/login` → 200.
+- Netns sharing proven: `gluetun`, `marreta`, `marreta_browser` all on the same
+  `net:[…]` inode; marreta reads the CDP endpoint
+  (`GET 127.0.0.1:9222/json/version` → `Lightpanda/1.0`).
+- SearXNG unaffected: `:8081` → 200 after the tunnel recreate.
+
+> **Gotcha hit during deploy:** the first seed used a bare-base64 `APP_KEY`,
+> which 500s every app route (see Secrets above). Fixed by re-keying with the
+> `base64:` prefix before any encrypted data was persisted.
+
 ## Citations
 
 - Marreta upstream: <https://github.com/manualdousuario/marreta> (README,

serverAppConfigs-docs/log.md

@@ -32,9 +32,17 @@ timestamp: 2026-09-14
   from `MARRETA_APP_KEY` / `MARRETA_ADMIN_EMAIL` / `MARRETA_ADMIN_PASSWORD`.
 - New test seam `tests/marreta_quadlet.bats` (17 contracts). deploy-plan.py:
   marreta joins the gluetun netns family. Doc: [[Marreta]].
-- **Not yet run live:** this box has no deploy key for Dankclaw. The deploy
-  and the Authentik provider registration must be run from a host with
-  access; see the doc's Deploy + Guard chain sections.
+- **Deployed live 2026-09-12 (rev `91e9410`)** after standing up passwordless
+  SSH from blankpad to the fleet. Ran `deploy.sh dankclaw --service gluetun
+  --service marreta --service caddy` (gluetun first: the new `8082:8085`
+  publish needs a tunnel recreate, which also cycles SearXNG). Authentik
+  `ProxyProvider` `marreta` registered (pk 13). Verified: unauth → Anubis
+  challenge; post-auth `:8017` → 200; container healthy; netns sharing proven;
+  SearXNG unaffected.
+- **Gotcha fixed in-flight:** the first seed used a bare-base64 `APP_KEY`,
+  which 500s every Laravel app route (`Unsupported cipher or incorrect key
+  length`). Re-keyed with the required `base64:` prefix before any encrypted
+  data persisted. See [[Marreta]] § Secrets.
 
 ## 2026-09-04 — *arr fleet consolidated on FrankBook-Pro; all egress VPN-gated
 - Operator decision: **FrankBook-Pro is the sole *arr deployment.** The