Split hosts: media (gateway at /), files, clips, sync; live gains /dock, /dock/clock, /dump, /me, /time

configure.py: three new host roles (files/sync/clips) in --full, --hosts, .env, Caddy generator;
main host serves about/ at the root (/about* redirects); /time only where it is fetched same-origin.
about/index.html links across hosts; addCommunityMediaServer.sh asks for the new names; Caddyfile.example
regenerated; README/FRESH-INSTALL/HOSTNAME-CHANGE (procedure C)/STATUS updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

FRESH-INSTALL.md

@@ -1,12 +1,12 @@
 # Fresh install — from an empty OVH box to a working stack with the deploy pipeline
 
 Everything in order. Scripted steps are commands; manual steps are click lists. `HOST` = your main hostname
-(ours: `ovh1.dumpstervigilantes.rip`), `BASE` = the parent domain. Detailed background for each part is in
+(ours: `media.dumpstervigilantes.rip`), `BASE` = the parent domain. Detailed background for each part is in
 README.md (section numbers given).
 
 ## 0. Before touching the server
-- DNS: `A` record for `HOST` → the server IP; `CNAME`s `auth`, `watch`, `git`, `bot`, `live` → `HOST`.
-  Optional: the bare domain `A` → server IP (it redirects to the watch site or `/about/`).
+- DNS: `A` record for `HOST` → the server IP; `CNAME`s `files`, `clips`, `sync`, `live`, `auth`, `watch`, `git`, `bot` → `HOST`.
+  Optional: the bare domain `A` → server IP (it redirects to `https://HOST/`).
 - Discord developer portal → New Application (one app serves Authentik login, the Jellyfin plugin's bot and the
   Discord bot):
   - OAuth2 → Redirects: `https://auth.BASE/source/oauth/callback/discord/` (the last segment is the Authentik
@@ -39,7 +39,7 @@ build, **firewall** (keep this session open; test a new ssh in a second terminal
 
     cd ~/vanguard-stream && ./configure.py --full
 
-Asks: main hostname; `auth`/`watch`/`git`/`bot`/`live` hostnames (defaults); bare domain (optional) and where it
+Asks: main hostname (the gateway page); `files`/`clips`/`sync`/`auth`/`watch`/`git`/`bot`/`live` hostnames (defaults); bare domain (optional) and where it
 redirects; Discord bot token + server ID (optional now, needed for the plugin feed); "is live" webhook (optional).
 Generates `.env` with every secret, the configs, starts all containers, waits, then runs the post-start fixups
 (Syncthing GUI auth off, Gitea admin user, Jellyfin plugin). `./configure.py --show` prints every credential
@@ -111,11 +111,11 @@ Log in at `https://git.BASE/` as `GITEA_ADMIN_USER` / `GITEA_ADMIN_PASSWORD` fro
    `DEPLOY_AUTO=1` in `.env` → `./configure.py --apply`; CI: `git mv .gitea/draft-workflows/ci.yml .gitea/workflows/ci.yml`.
 
 ## 9. Streamers, gamers, editors (README §5, §5a, §6)
-- Streamers: OBS → WebSocket server on; Docks → Custom Browser Dock `https://HOST/dock/` → Discord login →
+- Streamers: OBS → WebSocket server on; Docks → Custom Browser Dock `https://live.BASE/dock/` → Discord login →
   Settings: OBS WebSocket password; Timecode band → "Add band + clock source" (not streaming). Then title → Go Live.
-- Gamers: `https://HOST/clips/` → paste their Syncthing Device ID → accept device + folder on their PC (Send Only).
-  Syncthing UI (`https://HOST/sync/`, media-admins): Actions → Settings → Connections → incoming rate limit 12500 KiB/s.
-- Everyone: `https://HOST/about/`.
+- Gamers: `https://clips.BASE/` → paste their Syncthing Device ID → accept device + folder on their PC (Send Only).
+  Syncthing UI (`https://sync.BASE/`, media-admins): Actions → Settings → Connections → incoming rate limit 12500 KiB/s.
+- Everyone: `https://HOST/` (the gateway page; editors browse at `https://files.BASE/`).
 
 ## 10. Afterwards
 - Pin `AUTHENTIK_TAG` in `.env` to the running version. Rotate any secret that was ever pasted into chat.
@@ -128,7 +128,7 @@ Log in at `https://git.BASE/` as `GITEA_ADMIN_USER` / `GITEA_ADMIN_PASSWORD` fro
 
 Conventions: commands prefixed `dev$` run on your workstation (it has the repo at `~/claudevs/vanguard-stream`
 and your SSH key); `srv$` run on the server over ssh as `debian`. Replace `HOST` / `BASE` with your names
-(ours: `ovh1.dumpstervigilantes.rip` / `dumpstervigilantes.rip`). Click paths are written `App → Menu → Item`.
+(ours: `media.dumpstervigilantes.rip` / `dumpstervigilantes.rip`). Click paths are written `App → Menu → Item`.
 Every step ends with how you know it worked.
 
 ## A. DNS and Discord (no server yet)
@@ -180,7 +180,7 @@ D4. Log out/in once for the docker group:  dev$ ssh debian@HOST 'docker ps >/dev
 ## E. Configure and start the stack
 
 E1. dev$ ssh -t debian@HOST 'cd ~/vanguard-stream && ./configure.py --full'
-    Answers: HOST; Enter ×5 for the sub-hostnames; bare domain (Enter = BASE, or blank to skip) and its redirect;
+    Answers: HOST; Enter ×8 for the sub-hostnames; bare domain (Enter = BASE, or blank to skip) and its redirect;
     bot token (from A2) ; server ID (A3) ; "is live" webhook (optional); y to apply.
     (Pulls ~2 GB of images, starts 13 containers, waits, runs post-start fixups.)
 E2. dev$ ssh debian@HOST 'cd ~/vanguard-stream && docker compose ps --format "{{.Name}} {{.Status}}"'
@@ -282,13 +282,13 @@ I6. (later, when trusted) dev$ ssh debian@HOST 'cd ~/vanguard-stream && sed -i "
 ## J. People
 
 J1. Streamer (OBS): Tools → WebSocket Server Settings → Enable, set a password → OK.
-    Docks → Custom Browser Docks → name Vanguard, URL https://HOST/dock/ → Apply → log in with Discord inside the dock.
+    Docks → Custom Browser Docks → name Vanguard, URL https://live.BASE/dock/ → Apply → log in with Discord inside the dock.
     Dock → Settings: OBS WebSocket password → Save. Dock → Timecode band → "Add band + clock source" (while not streaming).
     Dock: title → Go Live.  Check:  dev$ ssh debian@HOST 'journalctl -u dumpd --since -5m --no-pager | grep mtx-auth | tail -1'  → "allow publish user=…".
-J2. Gamer: https://HOST/clips/ → follow the three steps on the page (install Syncthing, paste Device ID, accept device + folder as Send Only).
-    Admin check: https://HOST/sync/ shows their device connected. Once: Syncthing → Actions → Settings → Connections → Incoming Rate Limit 12500 KiB/s.
-J3. Editor: https://HOST/ (copyparty) → browse, download; https://HOST/finals/ to upload. Needs the editors role.
-J4. Everyone: https://HOST/about/.
+J2. Gamer: https://clips.BASE/ → follow the three steps on the page (install Syncthing, paste Device ID, accept device + folder as Send Only).
+    Admin check: https://sync.BASE/ shows their device connected. Once: Syncthing → Actions → Settings → Connections → Incoming Rate Limit 12500 KiB/s.
+J3. Editor: https://files.BASE/ (copyparty) → browse, download; https://files.BASE/finals/ to upload. Needs the editors role.
+J4. Everyone: https://HOST/ (gateway page).
 
 ## K. Verify the whole pipeline once