install.sh, deploy.sh and the runbooks cover the bot bundle path

install.sh installs deployBotBundle.sh as vanguard-deploy-bot and creates /srv/bot/app; the pipeline
reinstalls it when it changes. FRESH-INSTALL gains section 7a and appendix L (the first release, the
python312 runner label, the Gitea secrets, the Authentik app), with the appendix relettered so it stays in
order. README's rebuild list says the bot's repo is outside this one and what to restore where.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -497,7 +497,8 @@ secret) are gitignored and survive pulls; static pages are bind-mounted from the
 | `configure.py`, `dock/`, `clips/`, `about/`, stignore | `configure.py --apply` → Caddy reload, copyparty restart | none / a second |
 | `bin/*`, `systemd/*` | install; dumpd restart when it changed; timers pick up next run | a second |
 | `firewall/nftables.conf` | `nft -f` | none |
-| `docker-compose.yml`, bot image | `compose up -d --build` for changed services | that service |
+| `docker-compose.yml`, `bot/Dockerfile`, `bot/entrypoint.sh` | `compose up -d --build` for changed services | that service |
+| `deployBotBundle.sh` | reinstalled as `/usr/local/bin/vanguard-deploy-bot` (what dumpd runs for the bot's CI) | none |
 | anything that changes `mediamtx.yml` or the mediamtx service | **restart only when no stream is live**; otherwise deferred, `deploy-pending.timer` retries every 5 min | none while live |
 | `jellyfin-plugin-vanguard/dist/*.zip` (committed) | `installJellyfinPlugin.sh` | Jellyfin restart |
 | `live/` | `npm run build` on the server → `/srv/live` | none |
@@ -561,6 +562,10 @@ Still manual on a truly fresh box (not in the repo; documented in §5c–5g):
   the domain-level proxy provider + outpost host, the Jellyfin and Gitea OIDC providers, application bindings
 - Jellyfin: first-run wizard, libraries (Shows + Vanguard provider), SSO plugin + provider, branding
 - Gitea: authentication source (authentik), deploy key, webhook; `./registerGiteaRunner.sh`
+- Discord bot: its repo lives outside this one, so nothing here restores it. Put `BOT_DEPLOY_SECRET`
+  (`./configure.py --show`), `DISCORD_BOT_TOKEN` and `DISCORD_GUILD_ID` into that repo's Gitea Actions
+  secrets/variables, then push to its `main` — or install a bundle by hand with `./deployBotBundle.sh`.
+  `/srv/bot/app` is created empty by `install.sh`; the container idles until a release lands there.
 - Discord developer portal: application, redirect URIs, bot; DNS records
 A `.env`-driven Authentik blueprint would remove the first line (planned).
 
@@ -575,6 +580,8 @@ A `.env`-driven Authentik blueprint would remove the first line (planned).
     /srv/media/clips/<user>/.stlocal                             Syncthing ignore list maintained by the sweep
     /srv/media/clips/<user>/.src/clip.mkv                        raw source, only for clips that did NOT arrive via Syncthing
     /srv/media/clips/<user>/clip.normalize-failed.log            only if normalization failed; delete to retry
+    /srv/bot/app/                                                the Discord bot's installed release (bind-mounted at /app)
+    /srv/bot/previous/                                           the release before it (deployBotBundle.sh --rollback)
     /srv/media/finals/                                           editors upload here
     /srv/media/trash/<night>/...                                 dumped, purged after 3 days
     /srv/media/.markers/                                         dump markers