Deployment home is the tatlock-ui Portainer stack, not a standalone file

The gateway service now lives in system-admin-toj/containers/stacks/
tatlock-ui.yml (shared docker-dataplane network: speaches by service
name, host-run Tatlock by LAN IP). Drop deploy/desklock-gateway.yml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/architecture.md

@@ -258,9 +258,10 @@ Gitea Actions (`.gitea/workflows/build.yml`), following the tatlock/tatlock-ui p
   container.
 - Required repo/org secrets: `REGISTRY_USER`, `REGISTRY_PASSWORD`,
   `WATCHTOWER_TOKEN` (same trio tatlock uses).
-- The runtime stack definition lives in `deploy/desklock-gateway.yml`; copy it into
-  `system-admin-toj/containers/stacks/` to deploy, and register port 8600 in
-  `CONTAINERS.md`.
+- The gateway is a service in the **`tatlock-ui` Portainer stack**
+  (`system-admin-toj/containers/stacks/tatlock-ui.yml`, registered in
+  `CONTAINERS.md`): it shares `docker-dataplane` with Speaches (service-name URL
+  `http://speaches:8000`) and reaches the host-run Tatlock via LAN IP.
 
 Firmware is not containerized: it's flashed over USB (`idf.py flash`), with OTA planned
 for phase 5.