test fixes and doc work

CLAUDE.md

@@ -27,6 +27,51 @@ podman exec -it flyer-crawler-dev npm run type-check
 
 Out-of-sync = test failures.
 
+### Server Access: READ-ONLY (Production/Test Servers)
+
+**CRITICAL**: The `claude-win10` user has **READ-ONLY** access to production and test servers.
+
+**Claude Code does NOT have:**
+
+- Root or sudo access
+- Write permissions on servers
+- Ability to execute PM2 restart, systemctl, or other write operations directly
+
+**Correct Workflow for Server Operations:**
+
+| Step | Actor  | Action                                                                      |
+| ---- | ------ | --------------------------------------------------------------------------- |
+| 1    | Claude | Provide **diagnostic commands** (read-only checks) for user to run          |
+| 2    | User   | Execute commands on server, report results                                  |
+| 3    | Claude | Analyze results, provide **fix commands** (1-3 at a time)                   |
+| 4    | User   | Execute fix commands, report results                                        |
+| 5    | Claude | Provide **verification commands** to confirm success and check side effects |
+| 6    | Claude | Document progress stage by stage                                            |
+| 7    | Claude | Update ALL relevant documentation when complete                             |
+
+**Example - Diagnosing PM2 Issues:**
+
+```bash
+# Step 1: Claude provides diagnostic commands (user runs these)
+pm2 list
+pm2 logs flyer-crawler-api --lines 50
+systemctl status redis
+
+# Step 3: After user reports results, Claude provides fix commands
+pm2 restart flyer-crawler-api
+# Wait for user confirmation before next command
+
+# Step 5: Claude provides verification
+pm2 list
+curl -s https://flyer-crawler.projectium.com/api/health/ready | jq .
+```
+
+**Never Do:**
+
+- `ssh root@projectium.com "pm2 restart all"` (Claude cannot execute this)
+- Assume commands succeeded without user confirmation
+- Provide more than 3 fix commands at once (errors may cascade)
+
 ### Communication Style
 
 Ask before assuming. Never assume:
@@ -294,8 +339,8 @@ podman cp "d:/path/file" container:/tmp/file
 # Dev container
 MSYS_NO_PATHCONV=1 podman exec -e DATABASE_URL=postgresql://bugsink:bugsink_dev_password@postgres:5432/bugsink -e SECRET_KEY=dev-bugsink-secret-key-minimum-50-characters-for-security flyer-crawler-dev sh -c 'cd /opt/bugsink/conf && DJANGO_SETTINGS_MODULE=bugsink_conf PYTHONPATH=/opt/bugsink/conf:/opt/bugsink/lib/python3.10/site-packages /opt/bugsink/bin/python -m django create_auth_token'
 
-# Production (via SSH)
-ssh root@projectium.com "cd /opt/bugsink && bugsink-manage create_auth_token"
+# Production (user executes on server)
+cd /opt/bugsink && bugsink-manage create_auth_token
 ```
 
 ### Logstash