feat: Docker stack for PI WEB + Pi behind Traefik/Authelia

Compose services, Dockerfile, and deploy notes for pi.schwenk.online with OpenRouter and external Authelia middleware.

Co-authored-by: Cursor <cursoragent@cursor.com>

NOTES.md

@@ -0,0 +1,22 @@
+# NOTES.md
+
+## Status 2026-08-01
+
+Implemented Compose stack for PI WEB + Pi behind Traefik/Authelia. See [DEPLOY.md](DEPLOY.md), [SOUL.md](SOUL.md).
+
+**Blocked on Fränky for full e2e:** DNS `pi.schwenk.online`, Authelia live on boka, `OPENROUTER_API_KEY` in `.env`, deploy path `/home/frank/pi.schwenk.online`.
+
+## Local smoke (2026-08-01, this workstation)
+
+- `docker compose build` OK
+- `sessiond` listens on `/data/pi-web/sessiond.sock`
+- `web` HTTP `200` on `:8504`; `pi --version` → `0.82.1`
+- Full Authelia/DNS/TOTP path: only on boka after DNS + `.env` key
+
+Stack stopped locally after smoke (`docker compose down`).
+
+## Authelia handoff (locked)
+
+- Middleware: `authelia@docker`
+- Portal: https://auth.schwenk.online
+- Netz: `traefik`