docs(deploy): make deploy/ describe the deployment that actually exists

deploy/docker-compose.yml was unedited docs-mcp-template boilerplate —
untouched since the scaffold commit, still carrying <product>,
<registry> and <owner> placeholders — describing a standalone stack
that has never existed. crop-chem-docs runs as the `chem-mcp` service
inside Drawbar's parent compose.

It also set MCP_ALLOWED_HOSTS, which no code in this repo reads. The
knob is MCP_DISABLE_DNS_REBINDING_PROTECTION. Anyone who trusted the
old file and set an allowlist would have gotten a 421 on every request
with nothing in the logs to explain it.

- deploy/docker-compose.yml: replaced with the real chem-mcp block, a
  copy of what runs in Drawbar/drawbar-backend. Verified structurally
  identical to the parent (image, environment, expose, extra_hosts,
  restart, labels all equal). Carries the why for each setting: the
  :latest-vs-corpus-tag Watchtower trap (#339), the rebind-protection
  rationale, and that the OLLAMA_URL override is load-bearing because
  Drawbar's own ollama service is commented out — the image default
  http://ollama:11434 does not resolve in that stack, so without the
  override every search_docs call fails to embed its query.
- deploy/drawbar-compose-snippet.md: deleted. It was a second,
  differently-wrong copy (service name `crop-chem-docs`, ports
  8001:8000, and "No environment block needed — the image's defaults
  handle it", which is false on both the rebind and Ollama counts).
  Its still-true content (verification commands) moved into the compose
  file; the tag scheme and deploy chain were already in the README.
- deploy/rerank-docker.md: RERANK_URL said http://10.10.1.65:8082. In
  production the MCP reaches the sidecar by compose service name
  (http://llama-rerank:8080, baked into the image). Documents the
  network-attach gotcha that makes rerank fail silently, and keeps the
  host-IP form for local dev.
- README.md: file tree updated for the deleted file; Watchtower poll
  interval corrected 5 min -> 60s (WATCHTOWER_POLL_INTERVAL=60, as
  configured on trashpanda).

Verified: no <product>/<registry>/<owner> placeholders remain in
deploy/ or README, and all six env vars set in the block are ones the
server actually reads.

Closes #5

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01FFBDnRWHispovmJVK9rXc9

README.md

@@ -91,9 +91,9 @@ PRODUCT_NAME=crop_chem python -m docs_mcp.server --transport stdio
 ├── requirements.txt
 ├── Dockerfile
 ├── deploy/
-│   ├── docker-compose.yml         # Drop-in compose for Drawbar
-│   ├── drawbar-compose-snippet.md # Notes on the parent compose merge
-│   └── rerank-docker.md           # llama-rerank service deployment
+│   ├── docker-compose.yml         # The chem-mcp service block to merge
+│   │                              #   into Drawbar's parent compose
+│   └── rerank-docker.md           # llama-rerank sidecar deployment
 ├── .gitea/workflows/
 │   ├── refresh.yml                # Monthly cron: scrape + index + image push
 │   └── image-only.yml             # On-demand code-only ship cycle
@@ -140,7 +140,7 @@ Same Watchtower auto-deploy chain as seed-mcp. On every push to `main` that touc
 2. Rebuilds Chroma + BM25 (~few min on the GPU pool)
 3. `docker build` + push three tags to the LAN registry
 4. Links the package to the repo via Gitea API
-5. Watchtower on trashpanda polls `:latest` every 5 min → recreates `drawbar-backend-chem-mcp-1`
+5. Watchtower on trashpanda polls `:latest` every 60s → recreates `drawbar-backend-chem-mcp-1`
 
 Corpus refresh runs monthly via `refresh.yml`. EPA PPLS is the slow source — ~hours at 1 req/sec at full scale.