Document live GitOps production deployment

CLAUDE.md

@@ -29,12 +29,17 @@ Docker runs alongside local dev on different ports:
 The image does not set `BTCDATA_URL`; deployments must provide it. `BUILD_SHA` is embedded as
 `APP_VERSION` and exposed at `/api/version`. The port in `CMD` is hardcoded to 4040.
 
-## CI/CD
+## CI/CD and production
 
-`.gitea/workflows/build.yml` tests pushes to `main` and `v*` tags, then publishes immutable
-linux/amd64 images to `harbor.pmagnus.cloud/btcprice/btcprice`. It embeds the short Git SHA as
-`APP_VERSION`. CI has no Kubernetes credentials; the planned Flux deployment belongs in
-`magnus/deploy` once the shared GitOps gate is complete.
+`.gitea/workflows/build.yml` tests pushes to `main` and `v*` tags on the `anvil` Gitea Actions
+runner, then publishes immutable linux/amd64 images to
+`harbor.pmagnus.cloud/btcprice/btcprice`. It embeds the short Git SHA as `APP_VERSION`.
+
+Flux image automation updates the manifests in the separate `magnus/deploy` repository and Flux
+reconciles k3s. CI has no Kubernetes credentials. Production runs two replicas—one on hostinger and
+one on citadel—and is served at https://btcprice.k8s.pmagnus.cloud through ingress-nginx and
+hostinger Traefik TLS. Deployment changes belong in `../deploy/apps/btcprice`; do not deploy with
+Compose or manual `kubectl apply`.
 
 ## Legacy deployment
 
@@ -46,7 +51,7 @@ Mirrors `../elprice/deploy-citadel.sh`; no registry.
 - btcdata also runs on citadel, so both attach to the external `btc-network` there and
   `BTCDATA_URL` is `http://btcdata:4102` (service name, not a LAN address). The deploy script
   creates the network on the remote if it is missing.
-- Live at http://192.168.50.195:4041.
+- Temporary migration fallback at http://192.168.50.195:4041; it is not the production endpoint.
 
 ## Architecture