Bring the self-hosting guides in line with the shipped code

- geolite2: quote the real commented compose mount (./geolite2 to
  /opt/geolite2, the GEOLITE2_DIR default, so no env var is needed for
  the default path)
- getting-started: healthcheck probes /api/health, not /api/version;
  the environment module reaches archive-api and geocoding-api
  .open-meteo.com, relevant for egress allowlists
- mcp: the module is opt-in and off by default, but no longer the only
  such module
- reverse-proxy: the Coach stream is SSE over plain HTTP, not
  WebSockets; note that TRUST_PROXY_HOPS is not on the bundled compose
  whitelist and must be added by hand
- scaling: /api/health healthcheck; worker liveness is in-memory and
  invisible across a web/worker split; pool sizing now goes through
  getConnectionBudget with DB_CONNECTION_LIMIT as the compose knob and
  a 2-connection pg-boss share
- sso: the native SSO handoff shipped, OIDC_ONLY works with app builds
  that carry it
- unraid: geo databases are baked in only when the build had a licence
  key, or mounted; replaceable either way

docs/ops/deploy.md

@@ -44,8 +44,8 @@ and `WHOOP_WEBHOOK_SECRET` (HMAC secret for WHOOP webhook signature
 verification). Per-user WHOOP client id/secret live in Settings, not
 in the environment. See `docs/integrations/whoop.md`. The shipped
 `docker-compose.yml` already whitelists both under `environment:`; only
-a forked or older compose file needs them added by hand — vars not on
-the whitelist never reach the container.
+a forked or older compose file needs them added by hand, since vars not
+on the whitelist never reach the container.
 
 ### What goes wrong if you reverse it
 

docs/ops/encryption-key-rotation.md

@@ -48,12 +48,12 @@ under `v1` (the synthetic id assigned to the existing `ENCRYPTION_KEY`).
    ```
    The script is idempotent — running it again is a no-op for rows already
    prefixed with `v2.`. It rotates every registered encrypted column across
-   all models — the canonical registry lives in
-   `src/lib/crypto/encrypted-columns.ts`, and a guard test fails CI if any
-   `*Encrypted` column in the schema is missing from the registry or not
-   referenced by the script — plus the two non-`*Encrypted` members:
+   all models, plus the two non-`*Encrypted` members:
    `IntegrationStatus.lastError` and `CoachMessage.encryptedContent`
-   (Bytes). The summary line at the
+   (Bytes). The canonical registry lives in
+   `src/lib/crypto/encrypted-columns.ts`; a guard test fails CI if any
+   `*Encrypted` column in the schema is missing from the registry or not
+   referenced by the script. The summary line at the
    end shows `scanned`, `rotated`, and `errors` per table+field; treat
    `errors > 0` as a hard failure and re-run after fixing the cause.
 4. **Drop the old key (optional, recommended).** Once the script has run