docs: REUSE.md introduced — catalog conventions map (canonical app, healthcheck families, traps) + minimal CLAUDE.md

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

REPORT.md

@@ -1,39 +1,34 @@
-# REPORT — App-email gap closure: calcom + nextcloud wired (plaintext :2526 + split-From)
+# REPORT — docs: REUSE.md introduced (cross-repo reuse map)
 
-**Date:** 2026-06-29
-**Task:** Wire cal.com + nextcloud now that the controller (v0.89.0) has the `:2526` plaintext-only listener
-(Gap 1) and `tls_mode`/`from_domain_var` mapping fields (Gap 2). Catalog-only; live send-tests.
+**Date:** 2026-07-03 · **Class:** docs-only (no template change, no deploy effect)
+**Baseline:** `main` @ `bb81cd414afcb89e28ac60f405133f40195e6c43`
 
-## Mappings added
-- **nextcloud** (`tls_mode: plaintext`, split From): `host_var=SMTP_HOST`, `port_var=SMTP_PORT`,
-  `from_var=MAIL_FROM_ADDRESS`, `from_domain_var=MAIL_DOMAIN`, `from_local=nextcloud`; no `security_var`
-  (`SMTP_SECURE` stays empty = no TLS). Compose references the injected `${SMTP_*}` + `${MAIL_*}`.
-  **Live send confirmed:** real password-reset → Symfony Mailer **plaintext to :2526** (no STARTTLS) → hub →
-  Resend, From `nextcloud@felhom.eu` (split From), shim `hub=200`. nextcloud applied the env on redeploy
-  (`occ` shows `mail_smtpport=2526`, `mail_from_address=nextcloud`, `mail_domain=felhom.eu`) — every-boot
-  `getenv`, **no occ step needed (§8)**.
-- **cal.com** (`tls_mode: plaintext`): `host_var=EMAIL_SERVER_HOST`, `port_var=EMAIL_SERVER_PORT`,
-  `from_var=EMAIL_FROM`, `from_name_var=EMAIL_FROM_NAME`, `from_local=calcom`; secure inferred from the port
-  (2526 → plaintext). Compose references the injected `${EMAIL_*}`. Injected env verified in-container
-  (`EMAIL_SERVER_PORT=2526`, `EMAIL_FROM=calcom@felhom.eu`). **Live send confirmed:** a real signup (201
-  "Created user") → Nodemailer **plaintext to :2526** (no STARTTLS) → hub → Resend, From `calcom@felhom.eu`,
-  shim `hub=200`.
+## What was done
 
-## Pre-existing cal.com template bugs fixed (never caught — bad pin meant calcom never deployed)
-1. **Image pin `calcom/cal.com:v4.8.7` doesn't exist** as a published image (manifest unknown) → `v4.6.9`
-   (nearest valid 4.x; same `EMAIL_SERVER_*` behaviour).
-2. **Missing `DATABASE_DIRECT_URL`** — cal.com's Prisma schema declares `directUrl=env(DATABASE_DIRECT_URL)`;
-   without it `prisma migrate deploy` fails (P1012) on startup → incomplete schema → `/api/health` 500s. Added
-   (same direct Postgres URL).
-3. **Healthcheck path `/api/health` is 404 in v4.x** → container stayed unhealthy → Traefik wouldn't route it.
-   Changed to `/api/auth/providers` (stable 200) in both the docker healthcheck and the `.felhom.yml` probe.
+- **`REUSE.md`** created at the repo root (58 lines, light §2/§5-focused variant per spec):
+  the canonical example app (**paperless-ngx** — copy its structure), `.felhom.yml` required-field
+  set (verified across all 53 apps), deploy_fields conventions, the five Docker-healthcheck families
+  (BusyBox wget / curl / Node / Python / DB sidecars) each with a cited example, the memory
+  request/limit convention (`mem_limit` = sum of compose limits; limits enforced, no reservations),
+  the new-app checklist, and traps (gokapi entrypoint hack; legacy `templates.json` +
+  `scripts/generate-customer.sh`; uptime-kuma's image-specific healthcheck binary).
+- **`CLAUDE.md`** created (minimal — this repo had none): the REUSE.md pointer + same-commit
+  maintenance rule + the workspace CHANGELOG/REPORT convention. A full CLAUDE.md is a separate task.
+- `CHANGELOG.md` entry + `CONTEXT.md` created (one-liner).
 
-## Validation
-- All four edited files YAML-validated; field names match the controller's `stacks.SMTPMapping` tags.
-- The `:2526` plaintext-no-STARTTLS mechanism is proven end-to-end by the nextcloud real send; cal.com uses the
-  identical mechanism (Nodemailer) with its env verified.
+## Verification
 
-## Notes
-- **immich still unwired by decision** (Gap 3 — no SMTP env; needs config-file injection).
-- Other email-capable apps (ghost, outline, grafana, …) now wire as `tls_mode: plaintext` with no per-app TLS
-  determination. No secrets in any committed file.
+`python felhom.eu/scripts/reuse_refs_check.py e:/git/app-catalog-felhom.eu` →
+`OK [app-catalog-felhom.eu]: 10 cited paths, all exist`. Sweep: 53 apps scanned (all 53 descriptors
+share the same top-level key set; optional extras verified per file).
+
+## Observations (NOT acted on) — README drift, recorded in REUSE.md §6
+
+- README lists `templates/filebrowser/` (doesn't exist); omits `templates/recipe-importer/` (does).
+- README field-type table omits `subdomain` (all 53 apps use it) and `secret_input` (romm); lists
+  `boolean` which nothing uses.
+- README says smtp_mapping = "Vaultwarden, Mealie"; six apps carry it (calcom, gitea, mealie,
+  nextcloud, rallly, vaultwarden).
+- Healthcheck URL style drift (localhost vs 127.0.0.1, `curl -f` vs `-sf`, two Node one-liner styles).
+
+Cross-repo summary + full sweep counts: `felhom.eu/REPORT.md`.