init monlet repo with stage 0-2 (docs, contract, agent MVP)

docs/operations/deployment.md

@@ -0,0 +1,68 @@
+# Deployment
+
+This is an initial deployment plan, not a production runbook.
+
+## Agent
+
+Agent runs as a systemd service.
+
+Expected paths:
+
+- binary: `/usr/local/bin/monlet-agent`;
+- config: `/etc/monlet/agent.toml`;
+- state: `/var/lib/monlet-agent`;
+- logs: journald.
+
+The agent should support graceful shutdown and avoid overlapping runs for the same check.
+
+## Server
+
+Server runs in Docker.
+
+Production storage:
+
+- PostgreSQL.
+
+Local/demo storage:
+
+- SQLite may be supported later, but must be documented as non-production.
+
+Required deployment features:
+
+- TLS-ready reverse proxy;
+- agent API tokens;
+- request size limits;
+- structured logs;
+- `/health`;
+- `/ready`;
+- `/metrics`.
+
+Docker image rule:
+
+- build server dependencies inside the image;
+- do not require Python packages installed on the host;
+- do not mount host virtualenvs into the container;
+- local non-Docker development uses `server/.venv` only.
+
+## Web
+
+Web is read-only in v1.
+
+Auth plan:
+
+- reverse proxy basic auth or equivalent gateway auth;
+- no full RBAC in v1.
+
+## Observability
+
+Optional examples:
+
+- Prometheus scrape config;
+- Alertmanager route config;
+- Grafana dashboard stub.
+
+Metrics must avoid high-cardinality labels.
+
+## Backups
+
+PostgreSQL backup/restore docs are required before first production use.