chore(docs): add systemd service example, docker-compose, and troubleshooting (#49)

[savioruz]

Summary

Docs-only PR that ships the self-hosted deployment + troubleshooting story for issue #49.

• systemd unit (contrib/systemd/memayu.service): runs memayu serve as a persistent service — unprivileged memayu system user, Restart=on-failure, DB persisted at /var/lib/memayu/memayu.db via MEMAYU_LIBSQL_PATH, network-online.target ordering. Full setup snippet in the header comment.
• docker-compose (contrib/docker-compose.yml): ghcr.io/savioruz/memayu:latest, restart: unless-stopped, memayu-data named volume, and a healthcheck that waits for /api/health to return "status":"ready" (container is healthy only after first-run setup). Includes the local-embedder recipe.
• TROUBLESHOOTING.md (new): start with memayu doctor, then common config/storage/provider/env paths.
• README: deploy/systemd + docker-compose pointers and the readiness contract.

No Rust/schema changes. CI build/clippy/test/audit are unaffected by docs; cargo fmt is green.

Checklist

• Document and ship a systemd unit file example for running memayu serve as a persistent service #49 — systemd unit for memayu serve (persistent, unprivileged, restart-on-failure).
• docker-compose example with readiness healthcheck + volume persistence.
• TROUBLESHOOTING.md ships with memayu doctor guidance.
• README points to new deploy artifacts + readiness contract.
• no code/schema change.
• issue Document and ship a systemd unit file example for running memayu serve as a persistent service #49 tagged (reference comment posted; remains open until merge).

Security

• systemd unit runs as an unprivileged memayu user (not root); config.toml is chmod 600.
• Compose healthcheck uses the unauthenticated /api/health readiness probe (no credentials in the probe).

[savioruz]

Review of PR #65 at eb8d240596dc99a6bf998f17b749323099fbc47f (base main). Docs-only PR shipping self-hosted deployment + troubleshooting for issue #49.

🔴 Blocking

None. This is a documentation-only change (contrib/systemd/memayu.service, contrib/docker-compose.yml, TROUBLESHOOTING.md, README.md). No Rust code changes → CI build/clippy/test/audit are green-by-nature for docs; cargo fmt already pass; build/test pending is the repo-wide matrix (unaffected by docs).

🟡 Warning #1 — Dockerfile/compose healthcheck uses "ready" not setup_required, so a container reports "unhealthy" until setup completes

Per issue #47/#61, /api/health returns setup_required until the admin + provider config are in place. The compose healthcheck in this PR correctly waits for "status":"ready" (line ~"container transitions to healthy"). This is the right call, but it means docker compose ps (and k8s) will show unhealthy until first-run setup completes — worth a one-line callout in the troubleshooting section so operators don't mistake it for a crash. The compose file does call this out, but TROUBLESHOOTING.md should mirror it. Minor docs gap.

Validation

systemd unit (contrib/systemd/memayu.service) — issue #49

• Type=simple, ExecStart=/usr/local/bin/memayu serve, Restart=on-failure, RestartSec=5, WantedBy=multi-user.target. After=network.target, Wants=network-online.target (start after network). ✅ persistent service.
• Runs unprivileged: User=memayu/Group=memayu (system user, home /var/lib/memayu). WorkingDirectory=/var/lib/memayu.
• Environment=MEMAYU_LIBSQL_PATH=/var/lib/memayu/memayu.db keeps the DB in the persisted workdir; the header comment explicitly notes this overrides config.toml's libsql_path (transparent). ✅
• Setup steps documented (mkdir, useradd --system, chown, chmod 600 config). ✅ matches issue Document and ship a systemd unit file example for running memayu serve as a persistent service #49.

docker-compose (contrib/docker-compose.yml)

• image: ghcr.io/savioruz/memayu:latest, restart: unless-stopped, 8080:8080, named volume memayu-data for DB persistence, and a healthcheck curling /api/health and grep-ing for "ready" with start-period. ✅ mirrors the Dockerfile + README Docker example.
• Environment defaults documented (OpenAI-compatible); local-embedder recipe commented (MEMAYU_EMBEDDER_BACKEND: local, model, dim). ✅

TROUBLESHOOTING.md (new, 136 lines)

• Front-loads memayu doctor as the first diagnostic; sections for config/storage/provider/env issues; maps to the health endpoint. ✅ reasonable structure; ships alongside the systemd/compose examples from Document and ship a systemd unit file example for running memayu serve as a persistent service #49.

README update

• Adds a "Deploy" / systemd + Docker-compose pointer referencing the new contrib/ artifacts and the health endpoint readiness contract. (Content read in full.)

Migration / breaking

• Docs only; no code, no schema, no user-facing behavior change.

Checklist

• Document and ship a systemd unit file example for running memayu serve as a persistent service #49 — systemd unit example for memayu serve as a persistent service (unprivileged user, restart-on-failure, persisted DB).
• docker-compose example with unless-stopped + readiness healthcheck + volume persistence.
• TROUBLESHOOTING.md ships with memayu doctor guidance.
• README points to the new deploy artifacts + the readiness contract.
• no code/schema change.
• issue Document and ship a systemd unit file example for running memayu serve as a persistent service #49 tagged (reference comment posted); remains open until merge.

Note: PR description was edited pre-review (issue ref #49, checklist, scope clarification). CI build/test/audit are pending in the matrix but are unaffected by docs-only changes (cargo fmt green); if the maintainer prefers CI fully green before review, that is fine — the substantive checks (systemd semantics, compose healthcheck, troubleshooting coverage) are source-based and satisfied. Comment updated in place per ZeroClaw convention.