docs: deployment guide + per-client setup + connect matrix

- doc/deployment.md: run familiar as a remote MCP server — secure defaults,
  bearer vs OAuth modes, the full env-var reference, one-time login / token-store
  provisioning, the published images, docker compose, and TLS reverse-proxy
  blocks for nginx (proxy_buffering off + long read timeout), Caddy, and Traefik.
- doc/clients/: one page per client with exact working steps — Claude Code,
  VS Code (.vscode/mcp.json with a masked token input, and the workspace
  .mcp.json header gotcha), Mistral Le Chat, Claude Desktop + Cowork (mcp-remote
  bridge, per-OS config paths), and Claude web (oauth mode + external IdP, with
  "use Desktop + bearer" as the simpler alternative). Plus a clients/ index.
- README: a "Connect a client" matrix (client -> auth -> guide) and a compact
  "Deploy with Docker" section linking to doc/deployment.md; oauth mode noted.
- doc/README.md index: rows for Deployment and Client setup.
- doc/getting-started.md: pointer from the HTTPS quickstart to the full docs.
- CLAUDE.md: FAMILIAR_AUTH_MODE / FAMILIAR_OAUTH_* / FAMILIAR_ALLOW_INSECURE_BIND
  and /healthz in the transport note; the split ci.yml / docker.yml workflows.

Deployment docs live under the existing doc/ tree (the repo uses doc/, not a
separate docs/) to keep a single documentation directory.

doc/getting-started.md

@@ -106,6 +106,10 @@ To reach familiar from a **remote** MCP client (for example a [chat.mistral.ai](
 custom connector), run the opt-in **streamable-HTTP** transport instead. stdio stays the default;
 nothing here changes how `uv run familiar` behaves with no arguments.
 
+> This section is a quickstart. For the full production setup — Docker, reverse proxy (nginx / Caddy /
+> Traefik), the bearer vs OAuth modes, and the env-var reference — see [deployment](deployment.md), and
+> for exact per-client steps see [doc/clients/](clients/).
+
 ```bash
 FAMILIAR_HTTP_TOKEN=$(openssl rand -hex 32) uv run familiar serve
 ```
@@ -158,6 +162,16 @@ location /mcp {
 - **Copy the store** — run `familiar login` on your desktop, then copy the encrypted store
   (`token.enc` + `key` from your `FAMILIAR_DATA_DIR`) to the server's data dir.
 
+### Run it in Docker
+
+CI publishes a container image on every merge to `dev`/`main`
+(`git.hiddenden.cafe/hiddenden/familiar`, tags `:dev` and `:main`/`:latest`). It runs `familiar serve`
+as a non-root user on port `8080`, with a `/healthz` healthcheck and the encrypted token store under a
+`/data` volume. Use the bundled [`docker-compose.yml`](../docker-compose.yml): copy
+[`.env.example`](../.env.example) to `.env`, set `FAMILIAR_HTTP_TOKEN`, put your logged-in store in
+`./data`, then `docker compose up -d`. It publishes on `127.0.0.1:8080` only — the nginx block above
+proxies to it. The container refuses to start without `FAMILIAR_HTTP_TOKEN`.
+
 ### Add it in Mistral
 
 In [chat.mistral.ai](https://chat.mistral.ai): **Intelligence → Connectors → Add custom connector**,