docs: replace clone placeholder with rsync bootstrap + flesh out Forgejo first-run

- step 3: rsync files from desktop (Forgejo can't host its own bootstrap repo;
  VPS can't pull from a NAT'd desktop); note permanent Forgejo home + git bundle
- step 4: confirm Application URL / SSH domain+port / DB / RunAs=git, disable
  self-registration, create lowercase admin under Administrator Account Settings

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -84,18 +84,45 @@ docker --version && docker compose version   # confirm
 ```
 (Re-run `./scripts/check-vps.sh` — `DOCKER` should now report a version.)
 
-### 3. Create the shared network + bring up the stack
+### 3. Get the files onto the VPS + bring up the stack
+Forgejo doesn't exist yet, so this repo has no server to clone from during
+bootstrap. The VPS can't pull from your (NAT'd) desktop either — but your
+desktop can push to the VPS, and `docker compose` only needs the files, not
+git. So copy them up with rsync (run from your desktop, in `~/git/jb-infra`):
 ```sh
+rsync -av --exclude '.git' --exclude 'runner' --exclude 'scripts' \
+  ./ root@45.32.242.27:/opt/jb-infra/
+```
+(`runner/` and `scripts/` are desktop-side tools — they don't belong on the
+VPS.) Then on the VPS:
+```sh
+cd /opt/jb-infra
 docker network create edge          # MUST exist before `up`
-git clone <this repo> /opt/jb-infra && cd /opt/jb-infra
 docker compose up -d
 docker compose logs -f caddy        # watch the first cert issuance
 ```
+Once Forgejo is live (step 4+), create a `jb-infra` repo inside it and push
+this there for its permanent, versioned home; future infra edits then deploy
+like any other project. If you don't want git history on the box, a one-shot
+`git bundle` is an alternative to rsync (see project notes).
 
 ### 4. Configure Forgejo
-Browse to `https://git.joshbairstow.com` (cert should be live):
+Browse to `https://git.joshbairstow.com` (cert should be live). The install page
-- Complete first-run setup; create your admin user with a **lowercase**
+is mostly prepopulated from the env vars in `compose.yml` — confirm these, then
-  username (the registry path is case-sensitive and must be lowercase).
+complete it:
+- **Run As Username** stays `git` (the container's OS user, *not* your login).
+- **Application URL** must be `https://git.joshbairstow.com/` (not
+  `http://localhost:3000/`) — wrong value breaks `docker login`/push + clone URLs.
+- **SSH Server Domain** `git.joshbairstow.com`, **SSH Server Port** `222`,
+  **Database** `SQLite3`.
+- Under server settings: enable **Disable Self-Registration** (personal instance)
+  and **Hide Email Addresses by Default**; leave "Require Sign-In to View Pages"
+  off (it would block anonymous clones/pulls).
+- Expand **Administrator Account Settings** and create your admin user with a
+  **lowercase** username (e.g. `josh`) — this becomes your registry path
+  `git.joshbairstow.com/<owner>/…`, which must be lowercase.
+
+Then:
 - Confirm Actions is enabled (`Site Administration → Actions`).
 - Create a **Personal Access Token** with **`write:package`** scope
   (`Settings → Applications`). The automatic Actions token CANNOT push packages.