docs(marreta): record live deploy + the base64: APP_KEY gotcha

Deployed live at 91e9410 (gluetun+marreta+caddy), authentik provider pk 13,
guard chain verified end-to-end. Documented that Laravel APP_KEY must carry the
base64: prefix — a bare base64 key 500s every app route with 'Unsupported
cipher or incorrect key length' while /up still passes.

serverAppConfigs-docs/log.md

@@ -32,9 +32,17 @@ timestamp: 2026-09-14
   from `MARRETA_APP_KEY` / `MARRETA_ADMIN_EMAIL` / `MARRETA_ADMIN_PASSWORD`.
 - New test seam `tests/marreta_quadlet.bats` (17 contracts). deploy-plan.py:
   marreta joins the gluetun netns family. Doc: [[Marreta]].
-- **Not yet run live:** this box has no deploy key for Dankclaw. The deploy
-  and the Authentik provider registration must be run from a host with
-  access; see the doc's Deploy + Guard chain sections.
+- **Deployed live 2026-09-12 (rev `91e9410`)** after standing up passwordless
+  SSH from blankpad to the fleet. Ran `deploy.sh dankclaw --service gluetun
+  --service marreta --service caddy` (gluetun first: the new `8082:8085`
+  publish needs a tunnel recreate, which also cycles SearXNG). Authentik
+  `ProxyProvider` `marreta` registered (pk 13). Verified: unauth → Anubis
+  challenge; post-auth `:8017` → 200; container healthy; netns sharing proven;
+  SearXNG unaffected.
+- **Gotcha fixed in-flight:** the first seed used a bare-base64 `APP_KEY`,
+  which 500s every Laravel app route (`Unsupported cipher or incorrect key
+  length`). Re-keyed with the required `base64:` prefix before any encrypted
+  data persisted. See [[Marreta]] § Secrets.
 
 ## 2026-09-04 — *arr fleet consolidated on FrankBook-Pro; all egress VPN-gated
 - Operator decision: **FrankBook-Pro is the sole *arr deployment.** The