Add BIM Viewer to canonical deploy runner

infra/deploy-runner/README.md

@@ -0,0 +1,46 @@
+# NODE.DC deploy runner
+
+This directory stores the versioned source for the Synology canonical deploy runner.
+
+Live runner:
+
+```text
+/usr/local/sbin/nodedc-deploy
+```
+
+Synology staging candidate:
+
+```text
+/volume1/docker/nodedc-deploy/runner-install/nodedc-deploy
+```
+
+The runner accepts data-only app-overlay artifacts from:
+
+```text
+/volume1/docker/nodedc-deploy/inbox
+```
+
+Supported components in this source:
+
+- `engine`
+- `launcher`
+- `platform`
+- `tasker`
+- `ops-agents`
+- `bim-viewer`
+
+Install or update the root-owned live runner on Synology:
+
+```bash
+sudo install -o root -g root -m 0755 \
+  /volume1/docker/nodedc-deploy/runner-install/nodedc-deploy \
+  /usr/local/sbin/nodedc-deploy
+sudo /usr/local/sbin/nodedc-deploy verify-install
+```
+
+Normal service deploys must still use explicit artifacts:
+
+```bash
+sudo /usr/local/sbin/nodedc-deploy plan /volume1/docker/nodedc-deploy/inbox/<artifact>.tgz
+sudo /usr/local/sbin/nodedc-deploy apply /volume1/docker/nodedc-deploy/inbox/<artifact>.tgz
+```

infra/synology/README.md

@@ -251,19 +251,39 @@ echo 'launcher-pending-gate-ok'
 
 `bim.nodedc.tech` на Synology можно вести напрямую через DSM Reverse Proxy на `172.22.0.222:18100`. В этом режиме Platform Caddy не участвует в публичном BIM-трафике, но `Caddyfile.http` всё равно содержит BIM route как запасной вариант для маршрута через `172.22.0.222:18080`.
 
-Первый старт или обновление BIM после `BIM_REPO` sync:
+Canonical BIM deploy now uses `nodedc-deploy` with `component=bim-viewer`; do not deploy BIM by manually running `docker compose up` from the source directory as the normal path.
 
-```bash
+Live BIM root:
-cd /volume1/docker/nodedc-platform/bim-viewer/source
+
-sudo cp -n .env.synology.example .env
+```text
-# Проверить .env: NODEDC_INTERNAL_ACCESS_TOKEN должен совпадать с platform/.env.synology.
+/volume1/docker/nodedc-platform/bim-viewer/source
-sudo /usr/local/bin/docker compose \
-  --env-file .env \
-  -f docker-compose.beam.yml \
-  up -d --build --force-recreate ndc-beam-viewer nodedc-bim-converter
 ```
 
-Минимальная проверка на Synology:
+Live env stays outside artifacts:
+
+```text
+/volume1/docker/nodedc-platform/bim-viewer/source/.env
+```
+
+Before the first canonical apply, prepare `.env` from `.env.synology.example` and verify that `NODEDC_INTERNAL_ACCESS_TOKEN` matches `platform/.env.synology`. After that, `.env` must not be included in deploy artifacts.
+
+Canonical deploy commands:
+
+```bash
+sudo /usr/local/sbin/nodedc-deploy verify-install
+sudo /usr/local/sbin/nodedc-deploy plan /volume1/docker/nodedc-deploy/inbox/<bim-artifact>.tgz
+sudo /usr/local/sbin/nodedc-deploy apply /volume1/docker/nodedc-deploy/inbox/<bim-artifact>.tgz
+```
+
+The `bim-viewer` runner component:
+
+- applies payload under `/volume1/docker/nodedc-platform/bim-viewer/source`;
+- rejects `.env`, `server/data`, upload/model/comment/share runtime storage, `node_modules`, `.git`, shell hooks and backup files;
+- builds `nodedc/bim-converter:local` from `converter/Dockerfile`;
+- recreates only `ndc-beam-viewer` and `nodedc-bim-converter`;
+- healthchecks `http://127.0.0.1:18100/api/auth/session`.
+
+Минимальная проверка после apply:
 
 ```bash
 curl -k -fsS http://127.0.0.1:18100/api/auth/session