M41: harden trust boundaries and delivery

deploy/unraid/README.md

@@ -9,7 +9,7 @@ existing shared n8n remains available on its established port 5678.
 
 - Directory: `/mnt/user/appdata/mobilityops`
 - Compose project: `mobilityops`
-- Web: `http://192.168.10.150:1236` (`1236` on the host to `80` in `web`)
+- Public web: `https://fleetops.itworx.tech` (TLS reverse proxy to host port `1236`)
 - API and PostgreSQL: Compose network only
 - Shared n8n: `http://192.168.10.150:5678` (outside the MobilityOps Compose project)
 
@@ -17,14 +17,15 @@ existing shared n8n remains available on its established port 5678.
 
 Create `.env` from `.env.example`, replace every placeholder secret, set
 `MOBILITYOPS_ENV=production`, set both public URLs to
-`http://192.168.10.150:1236`, and retain `KNOWLEDGE_PROVIDER=demo` while RAGcore is not
-available. Keep `MCP_HUB_REGISTRATION_ENABLED=false` until the central Hub is ready.
+`https://fleetops.itworx.tech`, set `SESSION_COOKIE_SECURE=true`, and retain
+`KNOWLEDGE_PROVIDER=demo` while RAGcore is not available. The internal `1236` listener is
+an upstream for the TLS proxy, not a user-facing URL.
 
 ```bash
 cd /mnt/user/appdata/mobilityops
 ./deploy/unraid/configure-env.sh \
-  http://192.168.10.150:1236 \
-  http://192.168.10.150:5678/webhook/mobilityops-return
+  https://fleetops.itworx.tech \
+  https://n8n.itworx.tech/webhook/mobilityops-return
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml up --build -d db api web backup
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec api \
   python -m app.cli seed --reset
@@ -36,7 +37,7 @@ workflow into the existing n8n container:
 ```bash
 ./deploy/unraid/setup-existing-n8n.sh \
   n8n \
-  http://192.168.10.150:1236/api/v1/integrations/n8n/return-callback
+  https://fleetops.itworx.tech/api/v1/integrations/n8n/return-callback
 ```
 
 The callback token remains server-side and is never written to the repository. The