Add a stage branch deploy beside production on z00.

Pushing stage runs CI and deploys to stage.transcribe.z00.nu with its own data, Reverb credentials, and Caddy network.

README.md

@@ -157,24 +157,47 @@ Open [http://localhost:8080](http://localhost:8080) as usual. After changing Com
 
 ## CI/CD (Gitea Actions)
 
-On push to `main`, Gitea Actions (host runner on z00):
+Gitea Actions (host runner on z00) on push:
 
-1. Runs PHPUnit (+ compose config check)
-2. Builds and pushes `gitea.z00.nu/ben/andytranscribe:<sha>` (+ `:latest`) — Vite assets are baked in the image build
-3. Deploys by hard-resetting `~/andyTranscibe` to that SHA and pulling the image (`docker-compose.yml` + `compose.z00.yaml`)
+| Branch | Image tags | Deploy target |
+| --- | --- | --- |
+| `main` | `<sha>` and `:latest` | `~/andyTranscibe` → https://transcribe.z00.nu |
+| `stage` | `<sha>` and `:stage` | `~/andyTranscibe-stage` → https://stage.transcribe.z00.nu |
 
-Do not hot-patch production containers or the deploy checkout. Fix in git and push to `main` so CI deploys.
+Both runs:
+
+1. PHPUnit (+ compose config check for prod and stage env)
+2. Build and push `gitea.z00.nu/ben/andytranscribe:<sha>` — Vite assets are baked in; browser Reverb host/key come from Blade meta at runtime
+3. Hard-reset the matching checkout and pull the image (`docker-compose.yml` + `compose.z00.yaml`)
+
+Stage is a separate Compose project: own SQLite, uploads, `APP_KEY`, Reverb credentials, container names (`andytranscribe-stage-*`), host ports, and Caddy Docker network (`andytranscribe-stage-caddy`). Do not copy prod `.env` or data into the stage directory.
+
+Do not hot-patch production or staging containers or their deploy checkouts. Fix in git; push `stage` to preview, then `main` to ship.
 
 One-time server bootstrap (secrets + registry login):
 
 ```bash
 ./scripts/setup-gitea-ci.sh
+./scripts/setup-stage.sh
+```
+
+`setup-stage.sh` clones `$HOME/andyTranscibe-stage`, writes a unique `.env`, creates `andytranscribe-stage-caddy`, and attaches Caddy Proxy Manager to that network. You still need DNS for `stage.transcribe.z00.nu` and `reverb.stage.transcribe.z00.nu`, plus Proxy Manager hosts:
+
+- `stage.transcribe.z00.nu` → `andytranscribe-stage-app:80`
+- `reverb.stage.transcribe.z00.nu` → `andytranscribe-stage-reverb:8080`
+
+Create and push the branch after the workflow file is on the default branch:
+
+```bash
+git checkout -b stage
+git push -u origin stage
 ```
 
 Manual deploy of an already-built tag:
 
 ```bash
 APP_IMAGE=gitea.z00.nu/ben/andytranscribe:<sha> DEPLOY_PATHS=$HOME/andyTranscibe ./scripts/deploy-production.sh
+APP_IMAGE=gitea.z00.nu/ben/andytranscribe:<sha> DEPLOY_PATHS=$HOME/andyTranscibe-stage ./scripts/deploy-production.sh
 ```
 
 ## Services and ports
@@ -209,17 +232,17 @@ Edit `.env` before `docker compose up` when you need different ports or models:
 | `APP_HOST_PORT` | Host port for the web app | `8080` |
 | `REVERB_HOST_PORT` | Host port for WebSockets | `8081` |
 | `WHISPER_HOST_PORT` | Host port for Whisper | `8090` |
+| `REVERB_PUBLIC_HOST` | Browser WebSocket host (Blade meta) | `REVERB_HOST` |
+| `CONTAINER_PREFIX` | Docker `container_name` prefix | `andytranscribe` |
+| `CADDY_NETWORK` | External Caddy network (z00 overlay) | `caddy-proxy-manager-test_caddy-test-network` |
+| `PUBLIC_APP_URL` | Public URL injected by the z00 overlay (unset = prod) | `https://transcribe.z00.nu` |
 | `LOCAL_WHISPER_MODEL` | Whisper model id | `Systran/faster-whisper-base` |
 | `TRANSCRIPTION_TIMEOUT` | Job/HTTP timeout (seconds). Hung Whisper calls fail the job; UI can restart. | `600` |
 | `DB_QUEUE_RETRY_AFTER` | Must exceed `TRANSCRIPTION_TIMEOUT` | `660` |
 
-Inside Compose, Laravel talks to Whisper at `http://whisper:8000/v1` and publishes broadcasts to the `reverb` service. The browser connects to Reverb on `localhost:8081`.
+Inside Compose, Laravel talks to Whisper at `http://whisper:8000/v1` and publishes broadcasts to the `reverb` service. The browser connects using Reverb settings from the HTML meta tags (with Vite `VITE_REVERB_*` as a local fallback).
 
-If you change `REVERB_APP_KEY` or browser-facing Reverb host/port settings, rebuild so Vite embeds the new values:
-
-```bash
-docker compose up --build -d
-```
+If you change `REVERB_APP_KEY` or browser-facing Reverb host/port settings, restart the app container so Blade picks up the new values. An image rebuild is only needed when Vite-baked fallbacks must change.
 
 ### GPU Whisper (optional)