update

docs/deployment.md

@@ -127,15 +127,27 @@ Gitea uses its own SQLite database at
 `config/gitea/data/data/gitea.db`.
 
 For local testing that bypasses Nginx, set `BROKER_DIRECT_PORT` and
-`GITEA_DIRECT_PORT` in `.env`, then run:
+`GITEA_DIRECT_PORT` in `.env`. Set `GITEA_DIRECT_ROOT_URL` to the exact URL the
+test browser will use, including the VM hostname or IP address and port:
+
+```dotenv
+BROKER_DIRECT_PORT=8080
+GITEA_DIRECT_PORT=3000
+GITEA_DIRECT_ROOT_URL=http://192.0.2.10:3000/
+```
+
+Then run:
 
 ```sh
 ./manage.sh start-direct
 ```
 
-This adds host mappings to the broker's port 8080 and Gitea's port 3000. Do not
-use the direct-port override on an Internet-facing production VM. Return to the
-production port layout with:
+This adds host mappings to the broker's port 8080 and Gitea's port 3000. It
+also changes Gitea's root URL and session cookie policy to permit HTTP login.
+The direct broker port is suitable for health and API testing; technician
+OAuth login remains designed for the HTTPS public URL. Do not use the
+direct-port override on an Internet-facing production VM. Return to the
+production URL and secure-cookie policy with:
 
 ```sh
 ./manage.sh start
@@ -184,9 +196,10 @@ cd /YOUR/INSTALL/PARENT/TA-Deployment-Access
 ```
 
 The updater operates only on the current VM. It fast-forwards the checked-out
-branch, pulls the pinned Gitea image, rebuilds and restarts the local stack, and
-waits for the local broker to become healthy. It has no peer discovery, SSH, or
-multi-node update behavior.
+branch, pulls the pinned Gitea and Nginx images, rebuilds and restarts the local
+stack, and waits for the local broker to become healthy. Certbot is not pulled
+or run during a routine update; it is used only by `bootstrap` and `renew`. The
+updater has no peer discovery, SSH, or multi-node update behavior.
 
 Pin image versions as supplied and review release notes before changing them.
 Never change Gitea between rootless and rootful image families in place.