docs: two-repo Gitea workflow and LXC sync script for Ali operator

Add FORGE_CANONICAL_REGISTRY, ALI_GITEA_TWO_REPO_WORKFLOW, and sync-ali-omnl-banking-portal-lxcs.sh for banking LXCs 5820-5828.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md

@@ -0,0 +1,96 @@
+# Ali — two-repo Gitea workflow
+
+Canonical layout per [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md).
+
+## 1. Cursor Remote-SSH
+
+Connect to **`dev-bis-ali`** → open **`/srv/projects/proxmox`** for ops docs and orchestration scripts.
+
+## 2. Edit banking app code
+
+Primary workspace: **`~/smom-dbis-138`**
+
+```bash
+cd ~/smom-dbis-138
+git pull origin main
+# edit frontend-dapp/, services/, config/, etc.
+```
+
+## 3. Build and run on dev VM (`.59`)
+
+```bash
+cd ~/smom-dbis-138
+git pull origin main
+bash scripts/deployment/deploy-omnl-bank-production.sh
+bash scripts/deployment/deploy-omnl-domains.sh   # dev nginx only
+```
+
+Health checks:
+
+```bash
+curl -sf http://127.0.0.1:3011/api/v1/settlement/health | head -c 120
+curl -sf http://127.0.0.1:3012/api/v1/exchange/health | head -c 120
+curl -s -o /dev/null -w 'frontend=%{http_code}\n' http://127.0.0.1:3002/central-bank
+```
+
+## 4. Push to Gitea
+
+```bash
+cd ~/smom-dbis-138
+git add -A
+git commit -m "feat: your change"
+git push origin main
+```
+
+Remote: `https://gitea.d-bis.org/d-bis/smom-dbis-138.git`  
+Branch: **`main`**
+
+## 5. Production banking LXCs (5820–5828)
+
+Operator sync from LAN (dev-bis-ali or Proxmox host with `pct`):
+
+```bash
+cd ~/smom-dbis-138
+git pull origin main
+
+# dry-run (default)
+bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh
+
+# deploy all nine LXCs
+bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply
+```
+
+Single LXC:
+
+```bash
+export OMNL_PCT_CTID=5825
+bash scripts/deployment/deploy-omnl-banking-portal-pct.sh
+```
+
+## Env / secrets
+
+| File | Contents |
+|------|----------|
+| `/srv/projects/proxmox/.env` | Proxmox, NPM, Cloudflare, Gitea tokens |
+| `~/smom-dbis-138/.env` | `PRIVATE_KEY`, `RPC_URL_138`, `OMNL_API_KEY`, deploy keys |
+
+Both: `chmod 600`
+
+## Verify public endpoints
+
+From operator machine:
+
+```bash
+pnpm ali:hospitallers:verify-external
+```
+
+Expected: **14/14** public endpoints passing (9 portal FQDNs + API health routes).
+
+## Summary
+
+| Layer | Repo | Deploy target |
+|-------|------|---------------|
+| Banking app | `smom-dbis-138` | `~/smom-dbis-138` (dev) → `/srv/ali-portal` (each LXC) |
+| Ops / edge | `proxmox` | NPMplus, DNS, LXC map |
+
+One monorepo, nine public URLs, same stack on every banking LXC.

docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md

@@ -2,8 +2,7 @@
 
 Verified path: `pnpm ali:hospitallers:verify-external` → **PASS**
 
-Full canonical copy lives in the **proxmox** repo:
-`docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md`
+Mirrored in **proxmox** repo: `docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md`
 
 ## Path diagram
 
@@ -23,7 +22,7 @@ Ali laptop (Cursor)
 | LAN IP | `192.168.11.59` |
 | User | `dev1` (NOPASSWD sudo) |
 | Cursor workspace | `/srv/projects/proxmox` |
-| OMNL repo (on `.59`) | `~/smom-dbis-138` |
+| Banking app repo | `~/smom-dbis-138` → Gitea `d-bis/smom-dbis-138` |
 | Proxmox host | `root@192.168.11.13` |
 | Banking LXC CTIDs | `5820`–`5828` |
 | Banking deploy root (each LXC) | `/srv/ali-portal` → app `:3000` |
@@ -39,6 +38,10 @@ Ali laptop (Cursor)
 
 Refresh: `pnpm ali:hospitallers:handoff`
 
+## Two-repo layout (Gitea)
+
+See [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md) and [ALI_GITEA_TWO_REPO_WORKFLOW.md](./ALI_GITEA_TWO_REPO_WORKFLOW.md).
+
 ## Quick verify (from `.59`)
 
 ```bash
@@ -46,12 +49,19 @@ curl -s -o /dev/null -w '%{http_code}\n' http://192.168.11.211:8545   # expect 4
 ssh root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal'
 ```
 
-## Deploy OMNL to banking LXC
+## Deploy OMNL to banking LXCs
 
-From `dev-bis-ali`:
+All nine LXCs:
 
 ```bash
-export OMNL_PCT_CTID=5825   # or 5820–5828 per product
+cd ~/smom-dbis-138 && git pull origin main
+bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply
+```
+
+Single LXC:
+
+```bash
+export OMNL_PCT_CTID=5825
 bash ~/smom-dbis-138/scripts/deployment/deploy-omnl-banking-portal-pct.sh
 ```
 

docs/04-configuration/FORGE_CANONICAL_REGISTRY.md

@@ -0,0 +1,66 @@
+# Forge canonical registry — Gitea `d-bis`
+
+Single source of truth for which repositories Ali and operators use. **Do not** treat GitHub mirrors or ad-hoc “banking portal” repos as canonical.
+
+## Canonical repositories
+
+| Repo | Gitea remote | Path on `dev-bis-ali` | Role |
+|------|--------------|------------------------|------|
+| **`proxmox`** | `https://gitea.d-bis.org/d-bis/proxmox.git` | `/srv/projects/proxmox` | Operator / orchestration — manifests, LXC map, NPM, deploy orchestration |
+| **`smom-dbis-138`** | `https://gitea.d-bis.org/d-bis/smom-dbis-138.git` | `~/smom-dbis-138` | **Banking app source of truth** — all OMNL portal code |
+
+Optional: `proxmox` may vendor `smom-dbis-138` as a git submodule at `proxmox/smom-dbis-138`. Pick **one** primary workspace for app edits (`~/smom-dbis-138` recommended) and stay consistent.
+
+## Branch policy
+
+| Repo | Branch | Notes |
+|------|--------|-------|
+| `smom-dbis-138` | `main` | Production banking stack (commit `33e9316`+ verified on dev) |
+| `proxmox` | `main` | Operator scripts, LXC sync, infra docs |
+
+## What lives where
+
+### `smom-dbis-138` (banking app monorepo)
+
+```
+smom-dbis-138/
+├── frontend-dapp/              # Vite SPA → :3002 (dev) / :3000 (LXC edge)
+├── services/
+│   ├── settlement-middleware/  # /settlement/* → :3011
+│   ├── dbis-exchange/          # /exchange/* → :3012
+│   └── token-aggregation/      # /api/v1/* → :3000
+├── packages/
+│   ├── integration-foundation/
+│   └── settlement-core/
+├── config/                     # omnl-*.json, production configs
+├── deploy/nginx/               # omnl-domains.conf (dev nginx)
+└── scripts/deployment/
+    ├── deploy-omnl-bank-production.sh
+    ├── deploy-omnl-domains.sh
+    ├── deploy-omnl-banking-portal-pct.sh
+    ├── sync-ali-omnl-banking-portal-lxcs.sh
+    └── start-omnl-banking-portal.sh
+```
+
+### `proxmox` (ops)
+
+- LXC CTID map (5820–5828)
+- NPMplus proxy hosts (9 public FQDNs → LAN)
+- Cloudflare / DNS runbooks
+- `pnpm ali:hospitallers:handoff`, `pnpm ali:hospitallers:verify-external`
+
+## Public surface
+
+Nine FQDNs (see `config/omnl-production-domains.v1.json`) — **one stack**, deployed to each banking LXC at `/srv/ali-portal`. No per-FQDN git repos.
+
+## Credentials
+
+- Gitea user: **`ali`** — `ali-gitea-credentials.env` (handoff bundle)
+- Env split:
+  - `proxmox/.env` — Proxmox, NPM, Cloudflare, Gitea tokens
+  - `smom-dbis-138/.env` — `PRIVATE_KEY`, `RPC_URL_138`, OMNL API keys
+
+## Related docs
+
+- [ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md](./ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md)
+- [ALI_GITEA_TWO_REPO_WORKFLOW.md](./ALI_GITEA_TWO_REPO_WORKFLOW.md)