docs: describe React dashboard migration state

docs/deployment.md

@@ -23,8 +23,8 @@ Complete guide for deploying RedditBot in various environments.
 
 | Requirement | Version | Notes |
 |---|---|---|
-| Node.js | 18+ | LTS recommended |
-| npm | 9+ | Or yarn/pnpm |
+| Node.js | 20.19+ or 22.12+ | Required by the locked Vite toolchain |
+| npm | Bundled with Node | Use `npm ci` for lockfile-exact installs |
 | OpenRouter API Key | - | Sign up at [openrouter.ai](https://openrouter.ai) |
 | Reddit Account | - | With DM permissions enabled |
 
@@ -110,16 +110,21 @@ This will:
 ### 4. Start the Bot
 
 ```bash
-# Development (with TypeScript execution)
+# Terminal 1: backend with TypeScript execution
 npm run dev
 
-# Production (compiled JavaScript)
+# Terminal 2: Vite dashboard; proxies /api to port 3000
+npm run dashboard:dev
+
+# Production: compile server and dashboard, then start
+npm run build
 npm start
 ```
 
 ### 5. Access Dashboard
 
-Open http://localhost:3000 in your browser.
+Open the Vite URL (normally http://localhost:5173) during frontend development.
+Production and legacy-fallback checks use http://localhost:3000.
 
 ---
 
@@ -145,28 +150,18 @@ docker run -d \
   reddit-bot:latest
 ```
 
-### Dockerfile Structure
+### Dockerfile behavior
 
-```dockerfile
-# Build stage
-FROM node:18-alpine AS builder
-WORKDIR /app
-COPY package*.json ./
-RUN npm ci
-COPY . .
-RUN npm run build
+The image is based on the Playwright Jammy image rather than Alpine because the
+runtime needs Chromium and its system libraries. It installs Xvfb, x11vnc,
+noVNC, Fluxbox, and Websockify for interactive Reddit login; installs the locked
+Node dependencies; copies the repository; and runs `npm run build`.
 
-# Production stage
-FROM node:18-alpine
-WORKDIR /app
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/config.yaml ./config.yaml
-COPY --from=builder /app/package.json ./package.json
-
-EXPOSE 3000
-CMD ["node", "dist/index.js"]
-```
+That build produces both `dist/` for the Express server and
+`apps/dashboard/dist/` for Vite assets. Ports 3000 (dashboard/API) and 6080
+(noVNC) are exposed, and `docker/entrypoint.sh` starts the display services and
+application. This is a single-stage image and retains development dependencies
+needed by the current build/runtime layout.
 
 ---
 
@@ -271,9 +266,12 @@ app:
 
 ### Security
 
-1. **Network Isolation**: Run behind a reverse proxy with authentication
+1. **Network Isolation**: Keep the dashboard on a trusted network during the
+   migration cutover
 2. **Environment Variables**: Never commit credentials; use secrets management
-3. **Dashboard Access**: Restrict to internal network or add auth
+3. **Dashboard Access**: Authenticated Express hosting for React assets, API,
+   SSE, debug routes, and private media is a required cutover gate, not a
+   currently proven guarantee
 4. **Browser Data**: Protect `data/browser/` directory
 
 ### Performance