feat: complete dashcam catalog ingestion demo

deploy/portainer/README.md

@@ -0,0 +1,36 @@
+# Portainer / Swarm deployment
+
+`web`, PostgreSQL, `ingestion-worker`, and `ingestion-admin` are one stack. Do
+not deploy ingestion as a separate endpoint: the approved catalog is exchanged
+through the `catalog_exports` volume mounted read-only by web and read-write by
+the worker.
+
+In Portainer, create a Swarm stack from `deploy/swarm/docker-stack.yml`.
+Configure these values as stack environment variables:
+
+- `WEB_IMAGE` - digest-pinned web image.
+- `INGESTION_IMAGE` - digest-pinned ingestion image.
+- `POSTGRES_PASSWORD` - database secret.
+- `INGESTION_ADMIN_PASSWORD` - Basic Auth password for `/admin`.
+- `PUBLIC_HOST=videoreg.ru` and `TRAEFIK_NETWORK`.
+- Optional source/crawl settings: `MVIDEO_DASHCAM_CATEGORY_URL`, daily budgets,
+  and delay bounds.
+
+Keep every service on the same manager/placement constraint. The database,
+snapshots, read model, and shared catalog volume are local Docker volumes and
+must be backed up from that node.
+
+Gitea Actions uses `.gitea/workflows/master.yml`: it tests the repository,
+builds both images, pushes immutable digests, and deploys this one stack. The
+workflow connects to the Swarm manager, pulls those digests, and runs `docker
+stack deploy --with-registry-auth`; Portainer then shows and manages the same
+updated stack. Portainer does not need registry credentials or a separate
+webhook-based image build.
+
+Verification after deploy:
+
+```bash
+curl -fsS https://videoreg.ru/health/ready
+curl -u "$INGESTION_ADMIN_USERNAME:$INGESTION_ADMIN_PASSWORD" \
+  https://videoreg.ru/admin/api/queue
+```