Summary

Adds README documentation to all config subdirectories and fixes config gaps identified in the parity audit.

Changes

Documentation (9 new files)

• — root overview with directory layout, loading mechanisms, security notes
• — dev vs prod, routes, adding new routes, CORS, security headers
• — XML config files, query profiles, adding new configs
• — RBAC roles, protected collections, adding permissions
• — service account provisioning, gitignore rules
• — broker settings, ACL topics, TLS PKI, troubleshooting
• — init.sql vs extensions.sql, how they're applied
• — deployment schedules, cron expressions
• — crontab contents, rebuild requirement

Caddy Config Fixes (2 files)

• Add gRPC-Web proxy route (/grpc/* → grpc:50051 with h2c transport)
• Add CORS headers block (Access-Control-Allow-Origin *, methods, headers, max-age)
• Both dev and production Caddyfiles updated in sync

Docker Compose Fixes (1 file)

• Metabase: add MB_APPLICATION_ROOT: /metabase for correct subpath routing
• Metabase: change MB_EMBEDDING_APP_ORIGIN from hardcoded to env-var-driven
• Directus: fix CORS_ORIGIN default to include http://localhost (Caddy port)
• Caddy: mount ./services/maps volume for /maps/* static file route

Gitignore

• Add exception for config/keys/README.md (keys dir is gitignored)