M55: restore private RAGcore routing

deploy/unraid/README.md

@@ -22,6 +22,18 @@ Create `.env` from `.env.example`, replace every placeholder secret, set
 The internal `1236` listener is
 an upstream for the TLS proxy, not a user-facing URL.
 
+When RAGcore runs as a separate Compose project on the same host, keep its HTTP listener
+private and configure Fleet Ops through the existing shared Docker network, for example:
+
+```dotenv
+RAGCORE_BASE_URL=http://ragcore-app:8080
+RAGCORE_DOCKER_NETWORK=ragcore-proxy
+```
+
+The release deployer validates the network, attaches only the API replicas and takes the
+non-secret RAGcore URL from the server `.env` on every promotion. Tokens and the remaining
+resolved API environment continue to be inherited without being printed.
+
 ```bash
 cd /mnt/user/appdata/mobilityops
 ./deploy/unraid/configure-env.sh \