Deployment home is the tatlock-ui Portainer stack, not a standalone file

The gateway service now lives in system-admin-toj/containers/stacks/
tatlock-ui.yml (shared docker-dataplane network: speaches by service
name, host-run Tatlock by LAN IP). Drop deploy/desklock-gateway.yml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

AGENTS.md

@@ -93,10 +93,11 @@ make typecheck      # mypy
 - Deployment is CI-driven: pushing a `v*` tag makes Gitea Actions test, build, and push
   `desklock-gateway:{latest,tag}` to the registry and trigger Watchtower
   (`.gitea/workflows/build.yml`; needs `REGISTRY_USER`/`REGISTRY_PASSWORD`/
-  `WATCHTOWER_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The stack
-  file is `deploy/desklock-gateway.yml` — copy into
-  `system-admin-toj/containers/stacks/` and register the service + port 8600 in
-  `CONTAINERS.md` on first deploy.
+  `WATCHTOWER_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The
+  gateway deploys as part of the **`tatlock-ui` Portainer stack** —
+  `system-admin-toj/containers/stacks/tatlock-ui.yml` (registered in `CONTAINERS.md`,
+  port 8600). Stack updates go through the Portainer API on :8001 (JWT auth; recipe in
+  `system-admin-toj/containers/setup-new-host.md`), not by editing files on disk.
 - Verify speech changes against the live Speaches container with a real round trip
   (TTS → STT of a known phrase, expect the transcript back); warm timings to expect:
   STT ~0.3 s, TTS ~2 s per sentence.