- F-01: document the enforced DOCKER-USER firewall on :8080 (Traefik and
host RETURN, DROP everyone else), its persisting unit
nestquest-api-firewall.service, and operator verification commands;
restore step 6 no longer suggests hitting :8080 from the HA box.
- F-02: restore step 5 uses `dc up -d litestream` so the sidecar is
created on a fresh box instead of `dc start`, which cannot start a
never-created container.
- F-03: pin both reference routers to the `websecure` entrypoint.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
overseerandClaude Opus 5.5
d1f8f4b15b