update

docs/deployment.md

@@ -13,7 +13,9 @@ One Compose project manages:
 
 In production, only the configured Nginx HTTP and HTTPS ports are published.
 They default to 8680 and 8643. Inside Docker, Nginx listens on ports 80 and 443,
-the broker on 8080, and Gitea on 3000. Gitea SSH is disabled.
+the broker on 8080, and Gitea is explicitly pinned to `0.0.0.0:3000`. Gitea
+SSH is disabled. Deployment-level variables such as `HTTP_PORT` are not passed
+into the Gitea container, preventing them from overriding its internal listener.
 
 ## 1. VM and network