chore(ops): restart:unless-stopped so the stack survives host reboots

The Pi stack stayed down after a reboot (services had no restart policy). Add
restart:unless-stopped to postgres/backup/api/frontend (not the init-keys one-shot).
Also commits todo.md (running follow-ups: drafts fetch, live OAuth/subdomain, sent re-sync).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -1,5 +1,6 @@
 services:
   postgres:
+    restart: unless-stopped
     # pgvector-enabled Postgres 16 (semantic search). Drop-in for postgres:16 data;
     # the 'vector' extension is created by the AddEmbeddingColumn migration.
     image: pgvector/pgvector:pg16
@@ -27,6 +28,7 @@ services:
   # encrypted disk and be included in your off-machine backup regime (see SECURITY.md).
   # Restore: docker compose exec -T postgres psql -U inboxintel -d inboxintel < backups/<file>.sql
   backup:
+    restart: unless-stopped
     image: pgvector/pgvector:pg16
     entrypoint: /bin/sh
     command:
@@ -64,6 +66,7 @@ services:
       - keys:/keys
 
   api:
+    restart: unless-stopped
     build:
       context: .
       dockerfile: src/InboxIntel.Api/Dockerfile
@@ -98,6 +101,7 @@ services:
       - "127.0.0.1:8080:8080"
 
   frontend:
+    restart: unless-stopped
     build:
       context: ./frontend
       dockerfile: Dockerfile

todo.md

@@ -0,0 +1,54 @@
+# InboxIntel — TODO / follow-ups
+
+Outstanding items after the 2026-07-04 work session (UI refactor, category fixes, login fix,
+Pi deployment, mockups). Nothing here is blocking; these are the known loose ends.
+
+## Sync — Sent / Drafts folders
+The PHASE 2 category fix (PR #38) is correct — after a re-sync, **Spam and Trash now populate**
+(Trash 1363, Spam 112 on staging). But:
+
+- [ ] **Uncapped re-sync to confirm Sent.** Sent is still empty on staging only because of the
+      2000-message dev cap (`GmailSync:MaxMessages=2000`) + Gmail's newest-first ordering — the
+      newest 2000 are dominated by trash/promotions, so Sent/Draft/most Inbox mail falls outside
+      the window. An uncapped sync (`MAX_MESSAGES=0`, real deployment) should include Sent.
+      To re-run: `DELETE FROM sync_states` for the user, then reload the dashboard (auto-fires a
+      full sync). Note: the capped re-sync also left staging's Inbox sparse (~5) — staging-only.
+
+- [ ] **Drafts fix.** User added a drafts scope in Google Cloud console. Code side: `gmail.readonly`
+      already grants draft *read*, but `messages.list` doesn't return drafts — add a `users.drafts.list`
+      fetch in `GmailService`/`SyncService` and link the DRAFT label. (Add the new scope to
+      `GoogleOAuth:Scopes` in appsettings if compose/modify is needed for drafts too.)
+
+- [ ] Optional: with `IncludeSpamTrash=true`, a *capped* sync gets flooded by trash. If caps are
+      kept, consider prioritising non-trash or making the cap per-folder.
+
+## Pi deployment — real login
+InboxIntel is live on the homelab at http://192.168.50.13:8090 (auto-deploys from `develop`).
+
+- [x] Live message cap removed — `MAX_MESSAGES=0` in the Pi `deploy/.env` (takes effect on next sync).
+- [ ] **Google login on the Pi.** Subdomain: **inboxintel.cesnimda.uk** (user wiring traefik+TLS manually).
+      Redirect URI (in the new live Google OAuth client): `https://inboxintel.cesnimda.uk/signin-google`.
+      Once traefik is up: set `FRONTEND_ORIGIN=https://inboxintel.cesnimda.uk` in the Pi `deploy/.env`,
+      set `AllowedHosts`, and put the **new live** `GOOGLE_CLIENT_ID`/`GOOGLE_CLIENT_SECRET` in the Pi
+      `deploy/.env` (see below), then redeploy.
+- [ ] **Where the live OAuth ID/secret go: the Pi `/opt/inboxintel/deploy/.env`** (git-ignored) — NOT
+      Gitea secrets. The Pi auto-deploys via a cron `git pull` + `docker compose`, which reads
+      `deploy/.env` directly; there's no Gitea Actions runner on the Pi, so Gitea secrets wouldn't be
+      injected. (Gitea secrets only matter for the staging CD runner.)
+
+## Release / housekeeping
+- [ ] Decide on promoting `develop` → `main` and cutting a release tag (e.g. v0.1.0). `main` is
+      stale; all current work lives on `develop`. Stale PR #6 (develop→main) can be closed/redone.
+- [ ] Deferred by user: "Clean up my inbox" natural-language chat feature (do last).
+- [ ] Accessibility pass before launch (green accent must not be colour-only) — noted as nice-to-have.
+
+## Done this session (for reference)
+- Login 500 fixed (root-owned DataProtection keys volume) — PR #37
+- All 7 smart-category bugs fixed at source — PR #38
+- Email dashboard UX: split-view, custom checkbox, row polish, bulk/keyboard, dashboard
+  heatmap→category-bar, skeletons/empty states — PR #44
+- Dead backend heatmap removed — PR #45
+- .NET 10 migration, Renovate, DB backups, OpenTelemetry, hybrid semantic search, keyset
+  pagination, feature-flags foundation, Semgrep SAST (earlier PRs)
+- Resume mockups → F:\Pictures\website\inboxintel
+- Live Docker deployment + cron auto-deploy on pi@192.168.50.13