docs: one readme per part, ADR-010, release and update instead of deploy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/decisions/008-backend-and-ui-stack.md

@@ -16,15 +16,15 @@ the gateway already shows the stack is enough (ADR-007).
 - **API**: JSON under `/api/`: `heat-pump`, `energy`, `history?series=&range=`, `health`. The
   records in `home.backend.domain` and the examples in `backend/src/test/resources/api/` are
   the contract between backend and UI.
-- **Web UI**: React, TypeScript and Vite in `backend/web/`, Tailwind for styling, Recharts for
-  charts; the installation picture is a hand-drawn animated SVG component. Maven builds and
-  tests it (frontend-maven-plugin, Node installed per project) into the jar's `web/`. Polish texts.
-  Changed on 2026-10-24 at the user's request: the plain-JS UI was too weak to grow.
+- **Web UI**: React, TypeScript and Vite in `frontend/`, Tailwind for styling, Recharts for
+  charts; the overview animates an SVG layer over a picture of the installation. Polish texts.
+  Changed on 2026-10-24 at the user's request: the plain-JS UI was too weak to grow. Served by
+  its own nginx container, not by the backend (ADR-010).
 - **History**: series are an allowlist (`Series`); temperatures come from the legacy
   `Dom_Pompa.POMPA` fields, which already hold years of data.
 - **Auth**: not in the app; Traefik in front decides (the login method is still open, M3).
 
 ## Consequences
 
-- A JavaScript toolchain to keep up to date (`package-lock.json`); CI still needs only Java.
+- A JavaScript toolchain to keep up to date (`package-lock.json`); CI sets up Node as well.
 - `scripts/check.sh` builds and tests both projects.

docs/decisions/010-three-parts-in-docker.md

@@ -0,0 +1,31 @@
+# ADR-010: Gateway, backend and frontend as three images, each with its compose
+
+Status: accepted · 2026-10-24
+
+## Context
+
+The code had grown into a gateway at the root and a backend that also built and served the
+web UI. The Pi ran a jar under systemd, copied by a deploy script; Kraków runs Docker stacks
+from homelab-compose through Arcane. The user wanted the parts separate and each deployable the
+same way.
+
+## Decision
+
+- Three folders, `gateway/`, `backend/`, `frontend/`, each with a `Dockerfile` and a
+  `compose.yaml`. The backend serves only `/api/`; nginx in the frontend image serves the UI
+  and passes `/api/` to the backend, so they share one origin (CSP and the Origin check hold).
+- A pushed tag `vMAJOR.MINOR.PATCH` (`scripts/release.sh`) makes CI publish the three images in
+  the Gitea registry; the gateway also for arm64. The Dockerfiles build on the runner's own
+  platform and only copy into the final stage, so no emulation is needed.
+- The gateway runs in Docker on the Pi (Docker installed there, the OS untouched): host network
+  for Modbus, `/home/pi/home-pump` mounted at the same path, logs to journald. `update.sh` on
+  the Pi pulls a release with its `compose.yaml` and goes back to the previous one if `/health`
+  fails or the container restarts.
+
+## Consequences
+
+- No jar copying: the Pi and Kraków run the same published images; a version is a git tag.
+- The Pi needs Docker and, if the packages are private, a registry login: one-time steps.
+- CI needs Node and a `REGISTRY_TOKEN` secret with package write access.
+- Supersedes the systemd unit and `scripts/deploy-gateway.sh`; ADR-006 (gateway on the Pi)
+  stands.

docs/roadmap.md

@@ -24,18 +24,20 @@ their names and fields; new data goes into new measurements (ADR-005). The heat
 - [x] Influx writer: line protocol over JDK `HttpClient`, file buffer (fixes D2, D8)
 - [x] Poller: one virtual thread per device, snapshot, watchdog without `/health` polling (D1)
 - [x] HTTP: `/health` per device, `/snapshot`
-- [ ] Config file outside the jar (D3), wire `Main`, drop modbus4j, influxdb-java and the
-  baseline classes (D4, D5): PR #42, merged only together with the Pi steps below
-- [ ] On the Pi, each step approved: D7, config file and unit, IIO overlay and reboot, stop
-  `rpi-measurements` before the gateway polls the meter, deploy, then retire it
+- [x] Config file outside the jar (D3), wire `Main`, drop modbus4j, influxdb-java and the
+  baseline classes (D4, D5)
+- [x] Three parts with their images and compose (ADR-010); releases by tag, `update.sh` on the Pi
+- [ ] On the Pi, each step approved: D7, Docker, `gateway.json`, IIO overlay and reboot, stop
+  `rpi-measurements` before the gateway polls the meter, first `./update.sh`, then retire both
+  `rpi-measurements` and the old `home-pump.service`
 
 ## Next
 
 | Milestone | Scope | Done when |
 |---|---|---|
 | M2 Understand the controller | Timing (safe poll rate, response times), which pumps run in which state, open questions in `docs/frisko/` | `docs/frisko/` reviewed; F3 limits agreed |
-| M3 Backend and web UI, read-only | Backend in Docker in Kraków: history from Influx, snapshot from the gateway; F1, F2, F5, F7 with the schematic and charts after `research/ui/`; CI builds its image; Traefik route, Krosno only and no login for now (ADR-009). Backend, API and React UI are on master (ADR-008 proposed); open: image in Gitea, compose in homelab-compose (Arcane) | My father sees the heat pump and the energy on his phone |
-| M4 Setpoints | F3 through gateway commands with timed restore (ADR-006); CWU first, then CO; S1–S6. On master, not wired: command service with restores, FC6, token-protected `/commands`, backend `/api/setpoints` and presets, UI tab Ustawienia; wiring (off by default) is PR #53 on top of #42 | Father boosts hot water from his phone, value restored on time |
+| M3 Backend and web UI, read-only | Backend in Docker in Kraków: history from Influx, snapshot from the gateway; F1, F2, F5, F7 with the schematic and charts after `research/ui/`; Traefik route, Krosno only and no login for now (ADR-009). Backend, frontend and their images are on master (ADR-008 proposed, ADR-010); open: `REGISTRY_TOKEN`, first release, the stack in homelab-compose (Arcane) | My father sees the heat pump and the energy on his phone |
+| M4 Setpoints | F3 through gateway commands with timed restore (ADR-006); CWU first, then CO; S1–S6. On master and wired, off until `commands.enabled` (gateway/README.md: Enabling commands): command service with restores, FC6, token-protected `/commands`, backend `/api/setpoints` and presets, UI tab Ustawienia | Father boosts hot water from his phone, value restored on time |
 | M5 Alarms | F4; decide the channel first (e.g. ntfy, Telegram) | Simulated alarm reaches the phone |
 | M6 Native app? | Decide: keep the web UI, WebView wrapper or React Native | Decision recorded |