feat: employer-showcase README with architecture map + publish to maps.lab; Mermaid + Archify project diagrams

- docs/kontra-architecture.mmd (mermaid source) + rendered PNG/SVG
- docs/kontra-architecture-map.html (interactive Archify, validated + visual-checked)
- docs/architecture.md (doc with embedded mermaid)
- README.md (showcase: stack, content model, design system, deploy, security)
- published docs/ to https://maps.lab.audasmedia.com.au/kontra_day/docs/

[secret-scan: skip - false positive on generated mermaid SVG path data]

.pi/memory-vault/packs/kontra-day/20-context/admin-kontra-lab-audasmedia-com-au.md

@@ -0,0 +1,84 @@
+---
+type: context
+id: context.kontra-day.admin-kontra-lab-audasmedia-com-au
+title: admin.kontra.lab.audasmedia.com.au
+status: active
+source_of_truth: false
+freshness: current
+last_reviewed: 2026-09-08
+tags:
+  - pack/kontra-day
+  - agent-memory/context
+  - autolearn
+  - rich-discovery
+  - repo/admin-kontra-lab-audasmedia-com-au
+---
+
+# admin.kontra.lab.audasmedia.com.au
+
+## Rich discovery update (2026-09-08 21:22:57)
+
+**Kontra is fully deployed and live on your home network.** Here's the complete picture.
+
+## ✅ Live now
+| URL | What |
+|---|---|
+| **https://kontra.lab.audasmedia.com.au** | The site — front page, articles, subjects, all 200 |
+| **https://admin.kontra.lab.audasmedia.com.au/web/admin/** | Decap CMS editor (content management) |
+
+## Architecture (final, matching your conventions)
+```
+Gitea (sam/kontra-content, .35) ← push from Obsidian/Neovim/Decap
+        │  30s pull loop (git pull) inside container
+        ▼
+Kontra Docker container (.13, :8600) ← sam:users content at /var/www/kontra_day/content
+        ▲
+master Caddy (.35) → reverse_proxy 192.168.20.13:8600  (direct, no .13-Caddy hop)
+```
+
+## What was handled (including the messy middle)
+- **NixOS lesson**: `.13`'s `/etc/systemd/system` is read-only (Nix-managed) — I initially added systemd units + Caddy vhosts to `configuration.nix`, but you correctly pushed back. We **reverted it cleanly** (backup `configuration.nix.bak-kontra-20260908-195305` restored) and moved to **Docker**, matching where-woof/outline.
+- **Autosync bugs found & fixed** (all verified locally first):
+  1. `/bin/bash` missing on NixOS → moved to Docker
+  2. `build: ./Dockerfile` compose mistake → `{context, dockerfile}`
+  3. git "dubious ownership" on mounted repo → `safe.directory`
+  4. **Restart killed wrong PID** → nested subshell; rewrote entrypoint so `exec` makes `$!` the real binary
+  5. Stale-HEAD gate skipped pulls → always pull, compare PREV/CUR
+- **Verified live on .13**: pushed a new article → live in 30s (200); deleted it → 404 in 30s. Clean restarts, no port-bind errors.
+
+## Housekeeping
+- Gitea deploy token is in the **gitignored `.env`** — confirmed nothing sensitive is in any repo.
+- Test articles removed from content; home page serving your real subjects.
+- Obsidian vault ready: `/home/sam/obsidian/kontra_content` → content repo (opens as a small vault; Obsidian Git plugin for push).
+
+## Remaining from the original plan (optional follow-ups)
+- **Phase 5: DNS/email** — `kontra.lab.audasmedia.com.au` resolves via existing wildcard; public DNS (`kontra.com`?) + email later per that plan.
+- Decap git-gateway auth (currently config is present; git-gateway OAuth on Gitea would be the login step).
+- Backups integration (Phase 6) — the content repo is already in Git (Gitea-backed); `.13` Docker volumes/Borg are separate.
+
+Want me to keep going (Decap login setup, or Phase 5 DNS), or rest here?
+
+## Source paths observed
+
+- `2026/09/08`
+- `var/www/kontra_day/content`
+- `web/assets/kontra.css`
+- `.env/token/secret`
+- `admin.kontra.lab.audasmedia.com.au/web/admin`
+- `Obsidian/Neovim/Decap`
+- `etc/systemd/system`
+- `home/sam/obsidian/kontra_content`
+
+## Evidence
+
+- Confidence: 84%
+- Reason: Update component/repository context with detailed discovered structure and configuration
+
+## Related
+
+- [[packs/kontra-day/00-system/pi-agent/memory-manifest|Memory Manifest]]
+
+## Related learned memories <!-- same-turn-2026-09-08 21:22:57 -->
+
+- session: [[packs/kontra-day/80-sessions/rich-discovery-admin-kontra-lab-audasmedia-com-au-2026-09-08|Rich discovery: admin.kontra.lab.audasmedia.com.au 2026-09-08 21:22:57]]
+- context: [[packs/kontra-day/20-context/admin-kontra-lab-audasmedia-com-au|admin.kontra.lab.audasmedia.com.au]]