docs: mark site live on :1337 with cron auto-deploy; update owner tasks

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

PROJECT_STATUS.md

@@ -59,25 +59,25 @@
 6. **Theme-init is an external script** (`/theme-init.js`) so the CSP can use `script-src
    'self'` with no inline hash.
 
-## Pre-launch checklist (owner action)
+## Deployed — live
 
-- [x] ~~`/Linkedin` redirect target~~ — set to `https://www.linkedin.com/in/connor-babbington`.
-- [x] ~~JobTrack seed-data screenshots~~ — real captures integrated (`/assets/projects/jobtrack/`).
-- [x] ~~Real headshot~~ — integrated (`/assets/portrait.webp`, hero + about).
-- [x] ~~ATS-safe CV rework (EN/NO)~~ — done; generator in `tools/cv/`.
-- [ ] **InboxIntel screenshots** — still placeholders (no captures provided; it is "in development").
-- [ ] **Native-Norwegian review** of all NO content, incl. the NO CV (launch gate).
-- [ ] **Legacy WordPress URL inventory** → confirm the 301/410 map in `nginx.conf`.
-- [ ] Configure CI secrets (`REGISTRY_USER`, `REGISTRY_TOKEN`) + the relay `.env` on the server.
-- [ ] Confirm the Traefik entrypoint / cert-resolver names in `deploy/.env.example` match the host.
+- **Live on the `mediaserver` host at `http://<host>:1337`.** Stack: `deploy-site-1`
+  (nginx static, publishes 1337) + `deploy-relay-1` (contact relay, internal). Verified: all
+  routes + `/no/`, case studies, CV PDFs, images, `/Linkedin` 301, `/api/contact` proxy.
+- **Auto-deploy:** a 1-minute cron on the host (`deploy/autodeploy.sh`) pulls `main` and
+  `docker compose up -d --build` on change. `.gitea/workflows/deploy.yml` also exists for the
+  Gitea runner (activate once its job image has the Docker CLI + socket).
+- Repo cloned at `/home/pi/resumesite` (remote carries the deploy token — rotate/scrub if desired).
 
-## Infrastructure (verified live, July 2026)
+## Owner action remaining
 
-Deploy target is the `mediaserver` host (Ubuntu 24.04): ~30 Docker services behind **Traefik**
-(Cloudflare-fronted, TLS, HTTP/3), with **Authentik** SSO, **CrowdSec**, **Pi-hole**, and
-self-hosted **Gitea + Actions runner** (the CI/CD target for this site). The homelab case study
-and `deploy/` now reflect this (Traefik labels, `traefik_proxy` network). WordPress still runs
-but is being decommissioned as this site replaces it — not documented as future architecture.
+- [ ] **Point Cloudflare / your TLS proxy at host:1337** to serve it on `cesnimda.co.uk`
+      (retire the WordPress apex router as part of the cutover).
+- [ ] **Relay SMTP** — add creds to `/home/pi/resumesite/deploy/.env` (`SMTP_HOST/USER/PASSWORD`)
+      so the contact form sends; until then it degrades to the visible e-mail (POST returns 502).
+- [ ] **Native-Norwegian review** of all NO content, incl. the NO CV.
+- [ ] **InboxIntel screenshots** — mockups are in; swap for live captures if/when available.
+- [ ] **Legacy WordPress URL inventory** → confirm the 410 map in `nginx.conf`.
 
 ## Resolved