[Bccorb]

Closes #116

What changed

• New page, operate/production-checklist.mdx (sidebar order 4.5, right after Running In Production). An ordered, tickable checklist for taking a quickstart install to a public host: where the auth server should sit, production mode and the dev-mode guard, the five secrets, production JWKS keys and rotation, ISSUER/APP_ORIGINS/RPID/ORIGINS/FRONTEND_URL, OWNER_EMAIL, messaging, Postgres (incl. TLS), port binding with TLS and TRUST_PROXY, image verification and digest pinning, backup and restore, upgrades and rollback, one instance versus several, monitoring (/health/status and its degraded field), and post go-live checks.
• operate/deploy.mdx reworked. Removed the ../seamless-cli internal paths, the duplicated CLI command list (now links the CLI reference), and the "Documentation Rule" section, which was contributor guidance rather than reader content. Rewrote the garbled aside about how seamless init picks managed or local, against seamless-cli v0.24.0 src/commands/init.ts. The page now sends self-hosters to the checklist.

Why a new page rather than a rewrite of deploy.mdx

deploy.mdx answers "managed or self-hosted, and what does each mean". The checklist is a long procedure a person works through once per deployment and comes back to for upgrades and restores. Keeping them apart keeps the overview short and gives the checklist a stable URL to link from the comparison pages.

How it was verified

Every variable was checked against .env.example, docs/configuration.md, validateEnvs.sh and the source at tag v0.19.1. Against the real ghcr.io/fells-code/seamless-auth-api v0.19.1 image I ran:

• the cosign verification and digest resolution commands (signature passes; githubWorkflowSha matches the v0.19.1 tag),
• the key generation commands and the env file they write, with the compose file on the page, under NODE_ENV=production: the server boots, JWKS publishes the generated kid, /login returns an RS256 token with that kid, /docs is 404,
• the dev-mode guard refusing NODE_ENV=development with public ISSUER/APP_ORIGINS,
• TRUST_PROXY=1 honouring a forged X-Forwarded-For when hit directly, and Caddy with the page's Caddyfile shape replacing it with the real client,
• docker compose run --rm auth migrate,
• the pg_dump/dropdb/createdb/pg_restore sequence (audit hash chain continues after restore),
• a rollback of the image to v0.18.0 against the v0.19.1 schema (boots, but only once API_SERVICE_TOKEN is set, which the page now mentions),
• the jq -e 'has("degraded") | not' health check against both body shapes.

The managed-database pg_dump "$DATABASE_URL" line is standard PostgreSQL usage and was not run against a managed provider.

Depends on API PRs #457 and #458

• docs: refresh SECURITY.md and document container image verification seamless-auth-api#457 (image verification): the cosign, digest and git ls-remote commands are copied verbatim from its docs/production-operations.md#verifying-the-container-image. That section is not in v0.19.1, so the page carries the commands itself and does not link it. Once #457 merges, a link to it (for the SBOM and provenance steps) can be added.
• docs: correct the security posture and document per-instance limits seamless-auth-api#458 (security posture accuracy): the "one instance or several" table and the corrected key retirement step (wait access_token_ttl, not refresh_token_ttl) come from it. The page links the v0.19.1 production operations guide, which still says refresh_token_ttl for the retire step; that is overly cautious rather than unsafe. Once #458 merges, those links can point at the API's main branch or the next tag. The OWNER_EMAIL role wording (admin:write when available) also follows #458 and matches src/lib/ownerAdmin.ts at v0.19.1.

High availability stays out of scope (#115).

Checks

• npx prettier --check .: All matched files use Prettier code style!
• npm run lint: passes (eslint, check-no-h1, check-sdk-results; no output)
• npm run typecheck: Result (13 files): 0 errors, 0 warnings, 0 hints
• npm run build: 52 page(s) built, Complete!
• npm run check:matrix: not run; it already fails on main.