Deployment home is the tatlock-ui Portainer stack, not a standalone file

The gateway service now lives in system-admin-toj/containers/stacks/
tatlock-ui.yml (shared docker-dataplane network: speaches by service
name, host-run Tatlock by LAN IP). Drop deploy/desklock-gateway.yml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

AGENTS.md

@@ -93,10 +93,11 @@ make typecheck      # mypy
 - Deployment is CI-driven: pushing a `v*` tag makes Gitea Actions test, build, and push
   `desklock-gateway:{latest,tag}` to the registry and trigger Watchtower
   (`.gitea/workflows/build.yml`; needs `REGISTRY_USER`/`REGISTRY_PASSWORD`/
-  `WATCHTOWER_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The stack
-  file is `deploy/desklock-gateway.yml` — copy into
-  `system-admin-toj/containers/stacks/` and register the service + port 8600 in
-  `CONTAINERS.md` on first deploy.
+  `WATCHTOWER_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The
+  gateway deploys as part of the **`tatlock-ui` Portainer stack** —
+  `system-admin-toj/containers/stacks/tatlock-ui.yml` (registered in `CONTAINERS.md`,
+  port 8600). Stack updates go through the Portainer API on :8001 (JWT auth; recipe in
+  `system-admin-toj/containers/setup-new-host.md`), not by editing files on disk.
 - Verify speech changes against the live Speaches container with a real round trip
   (TTS → STT of a known phrase, expect the transcript back); warm timings to expect:
   STT ~0.3 s, TTS ~2 s per sentence.

deploy/desklock-gateway.yml

@@ -1,21 +0,0 @@
-# DeskLock gateway stack.
-# To deploy: copy into system-admin-toj/containers/stacks/ (Portainer) and
-# register the service + port 8600 in CONTAINERS.md.
-#
-# Image is built and pushed by .gitea/workflows/build.yml on version tags;
-# Watchtower picks up :latest afterwards.
-services:
-  desklock-gateway:
-    image: git.schweitz.internal/jpmschweitzer/desklock-gateway:latest
-    container_name: desklock-gateway
-    restart: unless-stopped
-    ports:
-      - "8600:8600"
-    environment:
-      # LAN IP of tower-of-joy: *.schweitz.internal resolves to localhost on the
-      # host, which is wrong inside a container. Switch to http://speaches:8000
-      # (and the tatlock service name) if this stack joins their docker networks.
-      - DESKLOCK_TATLOCK_BASE_URL=http://192.168.86.149:8000
-      - DESKLOCK_SPEACHES_BASE_URL=http://192.168.86.149:8601
-    labels:
-      - com.centurylinklabs.watchtower.enable=true

docs/architecture.md

@@ -258,9 +258,10 @@ Gitea Actions (`.gitea/workflows/build.yml`), following the tatlock/tatlock-ui p
   container.
 - Required repo/org secrets: `REGISTRY_USER`, `REGISTRY_PASSWORD`,
   `WATCHTOWER_TOKEN` (same trio tatlock uses).
-- The runtime stack definition lives in `deploy/desklock-gateway.yml`; copy it into
-  `system-admin-toj/containers/stacks/` to deploy, and register port 8600 in
-  `CONTAINERS.md`.
+- The gateway is a service in the **`tatlock-ui` Portainer stack**
+  (`system-admin-toj/containers/stacks/tatlock-ui.yml`, registered in
+  `CONTAINERS.md`): it shares `docker-dataplane` with Speaches (service-name URL
+  `http://speaches:8000`) and reaches the host-run Tatlock via LAN IP.
 
 Firmware is not containerized: it's flashed over USB (`idf.py flash`), with OTA planned
 for phase 5.