docs: phase 2 configuration and the reaper's containment

FREE_INSTANCE_REAP_AFTER is set only in docker-compose.site.yml, so a
self-hosted deployment can never reap. Admin and server must carry the
same value: one names the deletion date in warnings, the other acts on it.

Records that admin now has a second control-plane write path, cloudprov,
and that deletion lives in the control plane because that is where the
knowledge of what an instance is made of belongs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/docker-compose.site.yml

@@ -1,4 +1,9 @@
 services:
+    # Adds to the base `server` service defined in docker-compose.yml —
+    # only the cloud deployment reaps abandoned Free instances.
+    server:
+        environment:
+            FREE_INSTANCE_REAP_AFTER: "336h"
     site:
         image: gitea.hostxtra.co.uk/mrhid6/vantage/site:latest
         restart: unless-stopped
@@ -15,7 +20,6 @@ services:
             PORT: "8082"
             MONGO_URI: ${MONGO_URI:-}
             PUBLIC_URL: ${PUBLIC_URL:-}
-            APP_LOGIN_URL: ${APP_LOGIN_URL:-}
             SITE_ORIGIN: ${SITE_ORIGIN:-}
             TRUST_PROXY: ${SITE_TRUST_PROXY:-false}
             SMTP_HOST: ${SMTP_HOST:-}
@@ -45,6 +49,8 @@ services:
             SMTP_USERNAME: ${SMTP_USERNAME:-}
             SMTP_PASSWORD: ${SMTP_PASSWORD:-}
             SMTP_FROM: ${SMTP_FROM:-}
+            APP_LOGIN_URL: ${APP_LOGIN_URL:-}
+            FREE_INSTANCE_REAP_AFTER: "336h"
 
     # The staff and customer console, served at vantage-hq.hostxtra.co.uk.
     # ADMIN_API_URL is baked into the image at build time, not read here, so