OPS - GATEWAY: prepare Ops Agents Synology deploy

docs/ARCHITECTURE.md

@@ -249,13 +249,13 @@ This mode is policy-visible but cannot be fully enforced if Codex runs entirely
 Initial local target:
 
 ```text
-agents.local.nodedc -> Agent Gateway
+ops-agents.local.nodedc -> Agent Gateway
 ```
 
 Production-like domains should follow platform conventions:
 
 ```text
-agents.nodedc.ru or agents.<deployment-domain>
+ops-agents.nodedc.ru or ops-agents.<deployment-domain>
 ```
 
 The service should support:

docs/SYNOLOGY_DEPLOY.md

@@ -0,0 +1,105 @@
+# Synology deploy checklist
+
+This service is the NODE.DC Operational Agents Gateway for Tasker/Operational Core MCP traffic.
+
+## Network model
+
+- Public URL: `https://ops-agents.nodedc.ru`.
+- Synology reverse proxy: `HTTPS 443` → `HTTP 127.0.0.1:18190`.
+- Container app port stays `4100`.
+- Docker host port is controlled by `HOST_PORT=18190`.
+- Do not use `18090` for this module: that host port is reserved by Tasker / Operational Core.
+- No router changes are required if `443` already reaches Synology and Synology owns the reverse proxy rule.
+
+## Required env
+
+Create `.env` from `.env.synology.example` and replace every `replace-with-*` value:
+
+```env
+NODE_ENV=production
+HOST=0.0.0.0
+PORT=4100
+HOST_PORT=18190
+LOG_LEVEL=info
+
+NODEDC_AGENT_GATEWAY_PUBLIC_URL=https://ops-agents.nodedc.ru
+NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN=<strong-random-secret>
+NODEDC_LAUNCHER_INTERNAL_URL=<launcher-url-reachable-from-synology>
+NODEDC_TASKER_INTERNAL_URL=<tasker-url-reachable-from-synology>
+NODEDC_INTERNAL_ACCESS_TOKEN=<tasker-internal-access-token>
+
+POSTGRES_DB=nodedc_agent_gateway
+POSTGRES_USER=nodedc_agent_gateway
+POSTGRES_PASSWORD=<strong-random-postgres-password>
+```
+
+`NODEDC_TASKER_INTERNAL_URL` and `NODEDC_LAUNCHER_INTERNAL_URL` must be reachable from the Synology host/container. If Tasker and Launcher are still local-only on a workstation, deploy the gateway next to them or expose a private internal route first.
+
+## Backup before deploy
+
+Create a timestamped backup directory on the Synology host:
+
+```bash
+export BACKUP_DIR="$HOME/nodedc-backups/ops-agents-$(date +%Y%m%d-%H%M%S)"
+mkdir -p "$BACKUP_DIR"
+```
+
+Backup current compose/env files if the service already exists:
+
+```bash
+cp -a docker-compose.synology.yml .env "$BACKUP_DIR"/ 2>/dev/null || true
+docker compose --env-file .env -f docker-compose.synology.yml ps > "$BACKUP_DIR/compose-ps.txt" 2>/dev/null || true
+```
+
+Backup database if Postgres is already running:
+
+```bash
+docker compose --env-file .env -f docker-compose.synology.yml exec -T postgres \
+  pg_dump -U "${POSTGRES_USER:-nodedc_agent_gateway}" "${POSTGRES_DB:-nodedc_agent_gateway}" \
+  > "$BACKUP_DIR/postgres.sql"
+```
+
+## Deploy
+
+```bash
+docker compose --env-file .env -f docker-compose.synology.yml pull
+docker compose --env-file .env -f docker-compose.synology.yml up -d --build
+```
+
+If the repository is deployed from source and not from a registry image, `up -d --build` is enough. The production compose does not publish Postgres and binds the gateway to `127.0.0.1:18190`; DSM reverse proxy should target that local address.
+
+## Verification
+
+Local host checks:
+
+```bash
+curl -fsS http://127.0.0.1:18190/healthz
+curl -fsS http://127.0.0.1:18190/readyz
+curl -fsS -i http://127.0.0.1:18190/mcp | head
+```
+
+Public checks after DNS/reverse proxy:
+
+```bash
+curl -fsS https://ops-agents.nodedc.ru/healthz
+curl -fsS https://ops-agents.nodedc.ru/readyz
+curl -fsS -i https://ops-agents.nodedc.ru/mcp | head
+```
+
+Expected behavior:
+
+- `/` returns the public NODE.DC Operational Agents Gateway page.
+- `GET /mcp` returns a browser-safe informational page with HTTP `405`.
+- `POST /mcp` is the real MCP JSON-RPC endpoint and requires `Authorization: Bearer <agent-token>`.
+- `/readyz` does not expose internal Launcher/Tasker URLs or token configuration.
+
+## Tasker integration
+
+Tasker must call the gateway by internal URL:
+
+```env
+PLANE_NODEDC_AGENT_GATEWAY_URL=http://<synology-or-gateway-host>:18190
+PLANE_NODEDC_AGENT_GATEWAY_TOKEN=<same value as NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN>
+```
+
+After changing Tasker backend env, rebuild/restart the Tasker backend runtime so workspace settings can create agents and tokens through the gateway.

docs/UX_FLOW.md

@@ -118,12 +118,13 @@ The UI should provide:
 - show allowed workspace/project list;
 - show revoke button.
 
-The token itself should be shown once and never stored in frontend state longer than needed.
+The token itself should be returned once, shown masked in the active setup packet, and never returned by the backend again.
+The frontend may keep the full secret only in the current browser session for copy actions until reload/navigation.
 
 Recommended user-facing artifact:
 
 ```text
-TASKER_AGENT.md
+OPS_AGENT.md
 ```
 
 This file contains instructions, not the raw secret. Secrets should be passed through environment variables or Codex secret storage.