Add a setup guide for the Pi, and a compose file its .env selects

docs/PI.md goes from a Pi with Docker to a working claude.ai connector:
configuration, the first token, Caddy, DNS, the VPS forwarding raw TCP,
checks from outside, connecting the clients, the monthly token, updates,
backups and troubleshooting.

docker-compose.override.yml is tracked, so Compose would have merged it on
the Pi as well — publishing ports and switching the crawl timer off. The
Pi's .env sets COMPOSE_FILE to add deploy/docker-compose.pi.yml instead,
which joins the existing Caddy network by name and builds DATABASE_URL, so
nothing tracked needs editing there. Postgres moves to a private network
shared only with the server.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -1,14 +1,13 @@
-# Standalone Compose file for the Pi.
+# The server and its Postgres.
 #
-# If you already run Caddy and PostgreSQL from another Compose project, either
-# merge the `schulcloud-mcp` service below into that project's file, or keep
-# this file separate and attach it to the existing Caddy network — see the
-# `networks` block at the bottom and deploy/Caddyfile.snippet.
+# Locally, docker-compose.override.yml is merged in automatically (docs/LOCAL.md).
+# On the Pi, .env selects deploy/docker-compose.pi.yml instead, which attaches
+# the server to the network of the Caddy already running there (docs/PI.md).
 
 services:
-  # Dev/standalone Postgres. On the Pi, point DATABASE_URL at the existing
-  # instance instead and remove this service — the schema lives in its own
-  # database and user, so it coexists with whatever else is already there.
+  # The index's own Postgres, on a private network with the server. An existing
+  # instance works too — point DATABASE_URL at it and drop this service — but
+  # nothing requires sharing one.
   postgres:
     image: postgres:17-alpine
     container_name: schulcloud-mcp-db
@@ -19,8 +18,10 @@ services:
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-schulcloud}
     volumes:
       - pgdata:/var/lib/postgresql/data
+    # Only the server talks to Postgres. Keeping it off the Caddy network keeps
+    # it out of reach of whatever else shares that network on the Pi.
     networks:
-      - caddy
+      - backend
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U schulcloud -d schulcloud"]
       interval: 10s
@@ -54,6 +55,7 @@ services:
       - "8080"
     networks:
       - caddy
+      - backend
     logging:
       driver: json-file
       options:
@@ -73,8 +75,9 @@ volumes:
   state:
 
 networks:
+  backend:
   caddy:
-    # Set to true once this joins the network your existing Caddy already uses,
-    # and change the name to match (`docker network ls` to find it).
+    # On the Pi, deploy/docker-compose.pi.yml makes this the network your
+    # existing Caddy already uses (see docs/PI.md).
     external: false
     name: caddy