Add prerequisites, the first deploy on 10.60.1.14 (clone path, env file, secrets layout and permissions, port 8090 check), Authentik provider, application and group settings, DNS records with the AAAA caveat, the DOCKER-USER firewall unit, routine deploy and rollback to a previous SHA, photo restore, and secret rotation for the app key, OIDC secret, LLM key, VAPID keys and the NAS key. Record the host checkout state left by the pre-release first deploy. Task: 876134bc-9f1c-46b3-bc3c-0d889c2fd5f6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>