copyparty: read-only volume (no uploads); correct runbook anon-perms claim

-v /w::A granted anonymous full rwmda on the LAN (verified: anon PUT -> 201,
PROPFIND -> 207). New perms ::r:ra,dank: browse/download for anonymous
(required by the guarded files.franksdank.cloud chain), admin for dank,
no w/m/d for anyone. Runbook corrected with the --help-accounts semantics.

dankserver/compose.yaml

@@ -77,7 +77,12 @@ services:
     image: ghcr.io/9001/copyparty-ac:latest
     container_name: copyparty
     restart: unless-stopped
-    command: ["-a", "dank:${COPAY_PASS}", "-v", "/w::A"]
+    # read-only since 2026-08-31: copyparty perms are per-field "letters[,user]"
+    # with no user = every unauthenticated request. Anonymous gets r (browse +
+    # download; the guarded files.franksdank.cloud chain reaches copyparty
+    # unauthenticated after authentik). dank gets ra (admin panel). No w/m/d
+    # anywhere: uploads, moves, deletes rejected server-side. Interface: `--help-accounts` in-image.
+    command: ["-a", "dank:${COPAY_PASS}", "-v", "/w::r:ra,dank"]
     ports:
       - "3923:3923"
     volumes: