chore: add deployment docs, model script, and finalize env config

Phase 6 deployment infrastructure: finalize Dockerfile with OCI labels,
improve .env.example with grouped config keys, add scripts/pull-models.sh
for Mac-side model setup, and add docs/deploy.md covering the full
deployment topology, prerequisites, security model, and troubleshooting.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

progress.md

@@ -203,3 +203,26 @@ with the real SQLite-backed job queue and single worker loop.
   - Delegates to existing `ollamaProvider.New()` — zero new code paths.
   - DD#9 added to `v2/CLAUDE.md`.
   - PR: https://gitea.stevedudenhoeffer.com/steve/go-llm/pulls/4
+
+## Phase 6: Deployment infrastructure — 2026-05-23
+
+**Project is deployable.** All deployment artifacts are in place.
+
+- `Dockerfile` — finalized with OCI labels (`image.source`, `image.description`).
+  Multi-stage distroless build, CGO_ENABLED=0, `foreman serve` entrypoint.
+- `.env.example` — finalized with all 10 config keys from `internal/config/`,
+  grouped by function (daemon, model, persistence, polling, webhooks, job lifecycle)
+  with clear comments and example values.
+- `scripts/pull-models.sh` — executable helper to pull the recommended model roster
+  on the Mac (nomic-embed-text, qwen3:14b, qwen3:30b). Prints Mac-side Ollama
+  environment setup instructions.
+- `docs/deploy.md` — full deployment guide covering: topology overview, Mac
+  prerequisites (Ollama config, env vars, model pull, sleep prevention, firewall),
+  orgrimmar deployment (image registry, Komodo, config, persistence), security
+  model (internal-only, no public DNS, bearer tokens, HMAC), go-llm usage
+  (sync + async), and troubleshooting (6 common scenarios).
+- steveternet compose stack — PR to `steve/steveternet` adding
+  `azeroth/kalimdor/orgrimmar/foreman/docker-compose.yml` and `.env.example`.
+  Follows sibling conventions: `web` network (external), `unless-stopped`,
+  gitea registry image, Traefik labels for internal routing, named volume
+  for SQLite persistence, all config via `${VAR}` interpolation.