stage-9: consolidate into one compose stack behind nginx-proxy

psyc now runs as a single docker compose stack — cockpit + mock-cert +
(gpu-profile) inference — on the shared external `backend` network, fronted
by nginx-proxy as psyc.neuronetz.ai. Replaces the venv processes + one-off
docker run. MOCK_CERT_BASE and INFERENCE_URL are now env-configurable
(PSYC_MOCK_CERT_URL / PSYC_INFERENCE_URL) so the cockpit reaches the other
services by compose service name. Restart policies + healthchecks. deploy.md
rewritten to match.

Verified: cockpit serves directly and via the proxy; the full
scout→…→courier→ledger chain runs over the compose network.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -1,37 +1,71 @@
-# psyc — company-network deployment (cockpit + mock destination receiver).
+# psyc — neuronetz.ai deployment stack.
 #
-#   docker compose up -d --build
+#   docker compose up -d --build              # cockpit + mock-cert (no GPU)
+#   docker compose --profile gpu up -d --build  # + the live model (needs an NVIDIA GPU)
 #
-# WARNING: psyc has no built-in authentication. The cockpit exposes cases, the
-# ledger, and sealed-package metadata to anyone who can reach port 8767. Deploy
-# behind the company reverse proxy / SSO / VPN, or firewall the ports to the
-# SOC subnet. See docs/deploy.md.
+# The cockpit is fronted by the external `backend` network's nginx-proxy as
+# psyc.neuronetz.ai (point DNS for that name at the proxy host). mock-cert and
+# the inference server stay internal — no VIRTUAL_HOST, reachable only inside
+# `backend` by service name.
+#
+# WARNING: psyc has no built-in authentication. The reverse proxy / network
+# perimeter is the security boundary. See docs/deploy.md.
 
 services:
   cockpit:
     build: .
     image: psyc:latest
     command: ["psyc", "serve", "--host", "0.0.0.0", "--port", "8767"]
+    environment:
+      VIRTUAL_HOST: psyc.neuronetz.ai
+      VIRTUAL_PORT: "8767"
+      PSYC_MOCK_CERT_URL: http://mock-cert:8770
+      PSYC_INFERENCE_URL: http://inference:8771
     ports:
-      - "8767:8767"
+      - "8767:8767"          # direct/debug access; the proxy serves psyc.neuronetz.ai on :80
     volumes:
-      - psyc-data:/data
+      - ./data:/data
+    networks: [backend]
     restart: unless-stopped
-    # Behind a company egress proxy, uncomment and set:
-    # environment:
-    #   HTTPS_PROXY: http://proxy.corp:3128
-    #   HTTP_PROXY: http://proxy.corp:3128
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8767/healthz')"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
 
   mock-cert:
     image: psyc:latest
     command: ["psyc", "mock-cert", "--host", "0.0.0.0", "--port", "8770"]
-    ports:
-      - "8770:8770"
     volumes:
-      - psyc-data:/data
-    depends_on:
-      - cockpit
+      - ./data:/data
+    networks: [backend]
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8770/healthz')"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
 
-volumes:
-  psyc-data:
+  # The live fine-tuned model behind the Classifier bot. GPU-only — opt in with
+  # `--profile gpu`. Uses the psyc-trainer image (built from Dockerfile.train).
+  inference:
+    image: psyc-trainer
+    command: ["/scripts/serve_model.py", "--adapter", "/data/adapters/psyc-v4/final", "--host", "0.0.0.0", "--port", "8771"]
+    volumes:
+      - ./data:/data
+      - ./scripts:/scripts
+    networks: [backend]
+    restart: unless-stopped
+    profiles: ["gpu"]
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: all
+              capabilities: [gpu]
+
+networks:
+  backend:
+    name: backend
+    external: true