docs: keep only reference documentation, archive one-offs

docs/deployment.md

@@ -40,6 +40,22 @@ For a full initial rollout including backup + cleanup cron jobs:
 just deploy-all-first        # deploy + deploy-backup + deploy-cleanup-cron
 ```
 
+### First-time `APP_KEY` on a brand-new server
+
+`deploy-env` uploads the **local** `app/.env` only when the remote has none. Do
+**not** rely on a committed `.env` — generate a fresh key per environment and put
+it on the server before first `deploy`: create `app/.env` locally (see
+[development.md](development.md#appkey-and-the-appenv-file)) so `deploy-env`
+uploads it, or create `/var/www/xamxam/.env` on the server directly:
+
+```bash
+ssh xamxam 'sudo -u www-data bash -c "echo APP_KEY=\$(php -r \"echo base64_encode(random_bytes(32));\") > /var/www/xamxam/.env; chmod 640 /var/www/xamxam/.env; chown www-data:xamxam /var/www/xamxam/.env"'
+```
+
+If you ever rotate `APP_KEY`, re-encrypt the SMTP password with
+`just reencrypt-password <new_base64_key>` and push the new key via
+`just deploy-env`.
+
 ---
 
 ## Deploying