docs: align deployment/setup docs with current code

- nginx/docs/PRODUCTION_DEPLOYMENT.md: drop stale htpasswd/Basic-auth model,
  manual server-side deploy step, /var/www/posterg paths and hardcoded IP; describe
  the PHP-layer AdminAuth, automated 📋 Deploying nginx configuration…
xamxam.conf

sent 145 bytes  received 125 bytes  540.00 bytes/sec
total size is 10,012  speedup is 37.08
deploy-server.sh

sent 143 bytes  received 113 bytes  512.00 bytes/sec
total size is 8,519  speedup is 33.28, and what deploy-server.sh
  actually does.
- nginx/docs/QUICK_REFERENCE.md: replace htpasswd user management with AdminAuth
  guidance; fix php8.2->php8.4, log paths, admin rate limit (300r/m), socket path.
- nginx/README.md, nginx/SETUP.md: note 📋 Deploying nginx configuration…
xamxam.conf

sent 145 bytes  received 125 bytes  540.00 bytes/sec
total size is 10,012  speedup is 37.08
deploy-server.sh

sent 143 bytes  received 113 bytes  170.67 bytes/sec
total size is 8,519  speedup is 33.28 automates
  deploy-server.sh (no manual ssh/sudo step).
- docs/deployment.md: correct deploy-code scope (code-only, no --chown), fix the
  /var/log/xamxam provisioning step (deploy-server.sh via deploy-nginx, not
  deploy-code), document the setup-server.sh prerequisite and fresh-box caveat.
- README.md: replace the incomplete manual first-time setup snippet with the
  real setup-server.sh + provision-server flow and a fresh-box caveat.

docs/deployment.md

@@ -19,26 +19,44 @@ Deployment is orchestrated through the `justfile` (`deploy` group).
 
 ## One-time server setup
 
-From a machine with `ssh` access to the `xamxam` host, run the full remote
-provisioning once:
+From a machine with `ssh` access to the `xamxam` host, **first** bootstrap the
+role/user/dirs with `scripts/setup-server.sh` (creates the `xamxam` group, adds
+`www-data` and the deploy user to it, creates `/var/www/xamxam` and the
+cache/log/backup dirs), then run the full remote provisioning once:
 
 ```bash
+# 1. role/user/dir bootstrap (as root on the host):
+rsync scripts/setup-server.sh xamxam:/tmp/setup-server.sh
+ssh -t xamxam "sudo DEPLOY_USER=\$USER bash /tmp/setup-server.sh"
+
+# 2. full provisioning (env/APP_KEY + deploy + nginx + backup + cron + logrotate):
 just provision-server
 ```
 
+> **Fresh box caveat:** `provision-server` assumes `setup-server.sh` already ran.
+> On a truly empty `/var/www/xamxam` the deploy's rsync fails with
+> `Permission denied` on `storage/` until the setgid group-writable tree exists.
+> `scripts/deploy-server.sh` (via `just deploy-nginx`) is what normalises
+> ownership/perms on each deploy.
+
 This chains (each step is also runnable individually):
 
 1. `scripts/provision-server-env.sh` — ensure the server has an `APP_KEY` in
    `/var/www/xamxam/.env` (idempotent; see below).
-2. `just deploy` — code + Composer deps + migrations + permissions.
-3. `just deploy-nginx` — install + apply the nginx config and fix permissions.
-4. `just deploy-backup`, `just deploy-cleanup-cron`, `just deploy-tmp-cleanup-cron`, `just deploy-logrotate` —
-   install backup + cleanup (drafts + abandoned uploads) cron jobs and log rotation.
+2. `just deploy` — code + Composer deps + migrations + `deploy-nginx`
+   (install + apply the nginx config and fix permissions) + env + permissions check.
+3. `just deploy-backup` — install the backup script + cron jobs.
+4. `just deploy-cleanup-cron`, `just deploy-logrotate` — install the orphaned-
+   draft cleanup cron and log rotation.
 
 It finishes by telling you what's left to do in `/admin/account` (set the admin
 password — a fresh DB starts unauthenticated — and configure SMTP/PeerTube
 credentials and Nextcloud sync).
 
+> The abandoned-upload GC cron (`just deploy-tmp-cleanup-cron`) is **not** part
+> of `provision-server`; install it separately if you want hourly GC of
+> abandoned FilePond uploads.
+
 If you'd rather do it step by step (e.g. you already provisioned nginx):
 
 ```bash
@@ -81,7 +99,7 @@ If you ever rotate `APP_KEY`, re-encrypt the SMTP password with
 | Command | Purpose |
 |---------|---------|
 | `just deploy` | Full deploy: build + code + Composer deps + migrations + env + permissions check |
-| `just deploy-code` | rsync app files + nginx config + permissions (no Composer, no migrations) |
+| `just deploy-code` | rsync app files only (no Composer, no nginx, no migrations) |
 | `just deploy-deps` | Sync composer.{json,lock} → server, then `composer install`/`dump-autoload` |
 | `just deploy-migrate` | Run pending DB migrations on the server |
 | `just deploy-env` | Upload `app/.env` (only if the remote `.env` is absent — never overwrites a key) |
@@ -95,9 +113,9 @@ If you ever rotate `APP_KEY`, re-encrypt the SMTP password with
 > `just deploy-logrotate` to install log rotation. A single `just deploy-all-first`
 > chains all of these together.
 > The app log directory `/var/log/xamxam/` is provisioned automatically by
-> `deploy-code` on every run (via `deploy-server.sh`), so no separate step is
-> needed for it. To migrate logs written by an older build, run
-> `just migrate-log-names --apply` once.
+> `scripts/deploy-server.sh` on every `just deploy-nginx` (which `just deploy`
+> includes), so no separate step is needed for it. To migrate logs written by an
+> older build, run `just migrate-log-names --apply` once.
 
 ### Environment file & re-encryption
 
@@ -153,7 +171,9 @@ are purged by the cron above.
 
 ## Permissions model
 
-Managed/simulated by the justfile and verified by `deploy-verify-permissions`:
+Ownership and permissions are applied by `scripts/deploy-server.sh` (run via
+`just deploy-nginx`, which `just deploy` includes) and verified by
+`deploy-verify-permissions`:
 
 - Ownership: `www-data:xamxam`
 - Directories: **2775** (setgid — new files inherit the `xamxam` group)
@@ -161,6 +181,16 @@ Managed/simulated by the justfile and verified by `deploy-verify-permissions`:
 - `storage/xamxam.db` and other `*.db`: **660**
 - `app/.env`: **640**
 
+`just deploy-code` only rsyncs code (as the SSH/deploy user); it does **not**
+set ownership. Ownership is normalised afterwards by `deploy-server.sh`
+(`chown -R www-data:xamxam /var/www/xamxam`, setgid dirs, locked DBs). On a
+`xamxam` group-writable tree the rsync succeeds, then `deploy-nginx` (within
+`just deploy`) fixes ownership/perms. If `deploy-code` reports `Permission
+denied` on `storage/` (e.g. a fresh box where the dirs are not yet
+`www-data:xamxam` group-writable), re-apply `scripts/setup-server.sh` /
+`deploy-server.sh` first, or add `--chown=www-data:xamxam` to the rsync so it
+normalises ownership while transferring.
+
 The nginx/`deploy-server.sh` step (`just deploy-nginx`, or
 `sudo DEPLOY_USER=$USER bash /tmp/deploy-server.sh` via `just deploy-script`)
 fixes permissions and installs the nginx config.