deploy: platform-neutral runbook + compose/systemd examples, Synology doc slimmed to deltas

[cnewkirk]

Implements docs/superpowers/specs/2026-07-04-generic-deployment-docs-design.md (first commit on this branch).

What changed

• deploy/README.md (new) — invariants-first generic runbook: the circadian_daemon: block requirement, env-var-only key delivery, pre-pinned TLS, the data-dir/mount contract, host networking for SSE, supervision caveats, and healthy-start log lines; then three thin method sections (docker run / docker compose / bare-metal venv + systemd), the TV-bias shared-mount pattern, a daemon-less pointer, and a troubleshooting table.
• deploy/docker-compose.yml + deploy/systemd/hueman-circadian.service (new) — real, copyable artifacts the runbook links to.
• deploy/synology/README-docker.md — slimmed 183 → 74 lines to Synology-only deltas layered on the generic doc (paths, sudo docker path, Container Manager import, rsync-not-scp, tvsig permissions).
• README.md — three deployment pointers now lead with deploy/README.md.
• Also corrects two inherited inaccuracies: missing key fails with no application key (only a wrong key 401s), and the TLS-pin failure's real error text.

Verification

• 307 tests pass; compose file YAML-parses.
• Docs' technical claims cross-checked against hueman/cli.py, circadian_daemon.py, config.py, pin.py, client.py, and the Dockerfile in review.
• Deny-list grep clean over the tree and the branch history.

🤖 Generated with Claude Code