docs: add Claude rules and workspace configuration

.claude/rules/config-deploy.md

@@ -0,0 +1,45 @@
+---
+description: os.getenv + dotenv config, NIKE_ prefix, systemd + docker, fresh-env build order
+paths:
+  - "nike/config.py"
+  - ".env*"
+  - "nike.service"
+  - "Dockerfile"
+  - "docker-compose.yml"
+  - "run.py"
+  - "scripts/**"
+---
+
+# Config & deployment
+
+- **Config is `os.getenv` + `python-dotenv`, NOT pydantic-settings.** `config.py`
+  loads `.env` from the repo root (path-anchored, so it works regardless of CWD) and
+  reads `NIKE_*` vars into module constants. A new setting = a new
+  `os.getenv("NIKE_...", default)` **plus** a line in `.env.example`. Do not add a
+  `Settings` model.
+
+- **Every env var uses the `NIKE_` prefix** (`red_panda_standards.md`). DB config is
+  **individual parts** (`NIKE_DB_HOST/PORT/USER/PASSWORD/NAME`) — never a single
+  `DATABASE_URL`. `SERVER_HOST`/`SERVER_PORT` have no default and will raise if
+  unset (deliberate — a missing port should fail loudly, not bind somewhere random).
+
+- **`.env` is gitignored; only `.env.example` is tracked.** Never commit real
+  secrets. Keep `.env.example` in sync with the `NIKE_*` vars `config.py` reads.
+
+- **`NIKE_TRUSTED_PROXY` gates `X-Forwarded-*` trust.** `'*'` is safe only because
+  Nike's port is firewalled to HAProxy; keep that constraint in mind if the topology
+  changes.
+
+- **Fresh-environment build order:** `pip install -e .` → `scripts/apply_schema.py`
+  (provision the PG cache from `schema.sql`) → `cd dashboard && npm install && npm
+  run build` → `python run.py`. The dashboard build is a hard prerequisite for
+  serving `/`. Any change to this flow must keep the fresh path working.
+
+- **Deploy is systemd (`nike.service`) with a Docker option** (`Dockerfile` +
+  `docker-compose.yml`). Note the checked-in `nike.service` has a **stale
+  `WorkingDirectory`/`ExecStart`** (`/home/robert/gitea/nike`) — flag it if you
+  touch the unit; the repo lives at `~/git/nike`. Per the estate venv convention the
+  runtime venv is `~/env/nike`.
+
+- **`run.py` is the entry point** (`python run.py` → `nike.server:main` → uvicorn).
+  Keep it a thin shim.