feat(config,caddy): single gateway port and site.caddy per the komodo convention

README.md

@@ -68,7 +68,7 @@ with a whitelisted environment; the vault is read-only for it except
 
 ### 4. Mint a token
 
-Open admin at `http://localhost:62992` (or `https://<DOMAIN>/admin/` if Caddy), sign in with `ADMIN_USER` / `ADMIN_PASS`, go to **Tokens → Create**, scope `*` for first run.
+Open admin at `http://localhost:62990/` (or `https://<DOMAIN>/` if Caddy), sign in with `ADMIN_USER` / `ADMIN_PASS`, go to **Tokens → Create**, scope `*` for first run.
 
 ### 5. Smoke test
 
@@ -76,7 +76,7 @@ Open admin at `http://localhost:62992` (or `https://<DOMAIN>/admin/` if Caddy),
 docker exec beaver-gateway ls /vault | head
 docker logs beaver-gateway | grep -i "agent registered"
 
-curl http://localhost:62990/v1/models \
+curl http://localhost:62990/anthropic/v1/models \
   -H "Authorization: Bearer <YOUR_TOKEN>"
 ```
 
@@ -84,24 +84,25 @@ curl http://localhost:62990/v1/models \
 
 The admin dashboard renders ready-to-copy URLs and snippets for each of these
 
-- any Anthropic client: `http://localhost:62990` or `https://<DOMAIN>/anthropic`, model = agent name (`beaver-opus-high` etc)
-- MCP clients (Claude Desktop, Raycast extension): just find in admin
-- Obsidian companion plugin: paste the dashboard's **plugin base** (`http://localhost:62993` raw, or `https://<DOMAIN>/md` behind Caddy) into the plugin's "Base URL" setting
-- **Admin UI:** `http://localhost:62992` or `https://<DOMAIN>/admin`, login from `ADMIN_USER` / `ADMIN_PASS`
+Everything is on one port under its own path; Caddy forwards the whole domain as is.
+
+- any Anthropic client: `http://localhost:62990/anthropic` or `https://<DOMAIN>/anthropic`, model = agent name (`beaver-opus-high` etc)
+- MCP clients (Claude Desktop, Raycast extension): `/mcp/<name>/`, discovery page at `/mcp/`
+- Obsidian companion plugin: `/md` as the plugin's "Base URL", `/api` for the panel
+- **Admin UI:** `http://localhost:62990/` or `https://<DOMAIN>/`, login from `ADMIN_USER` / `ADMIN_PASS`
 
 ## Exposing to the internet
 
-Reference config in `caddy`. Designed for: gateway on rpi, Caddy on a server with a public IP, wired through tailscale.
+`caddy/site.caddy` holds the routes (one `reverse_proxy`, domain from `BEAVER_DOMAIN`); on a shared server it is bind-mounted into that server's Caddy as `projects.d/beaver-agent/`, on its own box `caddy/docker-compose.yml` runs a Caddy around it.
 
 ```bash
 cd caddy
 cp Caddyfile.example Caddyfile
-cp .env.example .env   # only for cloudflare
-# replace <DOMAIN>; point upstreams at wherever the gateway is reachable
+cp .env.example .env   # BEAVER_DOMAIN, BEAVER_UPSTREAM, Cloudflare token if any
 docker compose up -d
 ```
 
-Set `PUBLIC_BASE_URL=https://<DOMAIN>` in beaver-agent's `.env`. For per-subdomain layout, rewrite the Caddyfile and pass full `public_base_url=...` per frontend in `config.py`.
+Set `PUBLIC_BASE_URL=https://<DOMAIN>` in beaver-agent's `.env` so advertised endpoints use the outside origin.
 
 ## Editing config.py on the mac