wiki: plato auto-deploy (gitea webhook on dtoro/Plato → LXC 126:9799)

- infrastructure/auto-deploy.md: Plato pipeline added (Shape B,
  port 9799, hook id 8); ALLOWED_HOST_LIST gains 192.168.8.190;
  per-pipeline note for the LXC 126 specifics (origin URL, no
  ProtectHome); Changelog updated
- containers/126-plato.md: Auto-deploy section + Changelog entry

infrastructure/auto-deploy.md

@@ -23,6 +23,7 @@ The app repo at `/opt/<thing>` is the working tree, but the deploy tooling (`web
   - `192.168.8.230` ([claudio-bot (123)](../containers/123-claudio-bot.md))
   - `192.168.8.136` ([mule-images (120)](../containers/120-mule-images.md))
   - `192.168.8.77` ([hubris host](../hosts/hubris.md) — backup-library)
+  - `192.168.8.190` ([plato (126)](../containers/126-plato.md))
 
   **Don't strip these when editing app.ini.**
 
@@ -36,6 +37,7 @@ The app repo at `/opt/<thing>` is the working tree, but the deploy tooling (`web
 | `dtoro/gitea-customizations`    | [gitea (104)](../containers/104-gitea.md) `/var/lib/gitea/custom/` | A | `http://127.0.0.1:9797/deploy` (loopback) | (orig) | `systemctl restart gitea` if templates changed |
 | `dtoro/mule-image`              | [mule-images (120)](../containers/120-mule-images.md) `/opt/mule-image/` | B | `http://192.168.8.136:9797/deploy` | 6 | `docker compose up -d --build` |
 | `dtoro/Artifacto`               | [apps (105)](../containers/105-apps.md) `/opt/artifacto/` | B | `http://192.168.8.205:9798/deploy` | 7 | `docker compose up -d --build` |
+| `dtoro/Plato`                   | [plato (126)](../containers/126-plato.md) `/opt/plato/app/` | B | `http://192.168.8.190:9799/deploy` | 8 | `docker compose up -d --build` |
 | `dtoro/claudio-bot`             | [claudio-bot (123)](../containers/123-claudio-bot.md) `/opt/claudio-bot/` | A | `http://192.168.8.230:9797/deploy` | (orig) | `pip install` + `systemctl restart claudio-bot` |
 | `dtoro/backup-library`          | [hubris host](../hosts/hubris.md) `/opt/backup-library/` | A | `http://192.168.8.77:9798/deploy`  | (orig) | runs `deploy.sh` (preserves admin-edited `/etc/restic/include-*.list`) |
 
@@ -49,6 +51,7 @@ Always commit + push. Local-only edits drift. Common ones:
 - `/var/lib/gitea/custom/` ↔ `dtoro/gitea-customizations` (auto-deploys)
 - `/opt/artifacto/` ↔ `dtoro/Artifacto` (auto-deploys)
 - `/opt/mule-image/` ↔ `dtoro/mule-image` (auto-deploys)
+- `/opt/plato/app/` ↔ `dtoro/Plato` (auto-deploys)
 - `/opt/claudio-bot/` ↔ `dtoro/claudio-bot` (auto-deploys)
 - `/opt/backup-library/` ↔ `dtoro/backup-library` (auto-deploys)
 
@@ -62,6 +65,11 @@ Always commit + push. Local-only edits drift. Common ones:
 - Receiver is on **loopback** (`127.0.0.1:9797`), not the LXC IP.
 - Online3DViewer binary assets are NOT tracked; `deploy.sh` fetches them on first run.
 
+### Plato
+- Shape B (`/opt/plato-deploy/{webhook.py,deploy.sh}`, port `9799`).
+- The in-LXC checkout's `origin` is `http://192.168.8.121:3000/dtoro/Plato.git` (internal gitea), and git creds are at `/root/.git-credentials` rather than the `/etc/plato-deploy/git-credentials` pattern — the unit doesn't set `ProtectHome` so root's home is reachable.
+- `/data` is a host bind (`/mnt/library/documents/plato`), so `docker compose up -d --build` rebuilds the image + restarts the container without touching the SQLite db. The [fresh-DB bootstrap workaround](../containers/126-plato.md#fresh-db-bootstrap-workaround) only matters if you blow `plato.db` away.
+
 ### mule-image / Artifacto
 - Async deploy (returns 202) — gitea would otherwise time out the request. Logs: `pct exec <id> -- journalctl -u <thing>-deploy-webhook -f`.
 - **Cloning from inside the LXC must use the internal gitea IP** (`http://192.168.8.121:3000/...`). `https://git.hubris.network` hits a connection reset from inside [apps (105)](../containers/105-apps.md) (Caddy routing / TLS hairpin not configured for this LXC). Configured `origin` on the in-LXC checkout is the internal URL.
@@ -80,6 +88,9 @@ Always commit + push. Local-only edits drift. Common ones:
 
 ## Changelog
 
+### 2026-05-13 — Plato pipeline added
+Webhook id 8 on `dtoro/Plato` (port `9799` on [plato (126)](../containers/126-plato.md)). `app.ini` `ALLOWED_HOST_LIST` extended to include `192.168.8.190`.
+
 ### 2026-04-28 — wiki entry created
 Initial documentation. Six active pipelines.