docs: refresh README + CLAUDE.md for current modules; add deploy guide for any Claude

- README/CLAUDE.md: Inventory depth (warranty/value/maintenance/sold/custom fields,
  HomeBox CSV import), Locations page, the two-world data-model rule, API-first +
  service-layer conventions, and the HTTPS-gated future work (MCP/PWA/camera)
- New docs/git-deploy-guide.md: self-contained git + deploy walkthrough for a
  Claude instance working without this repo's CLAUDE.md (NAS is a git checkout,
  push + pull/rebuild, never rsync, secrets in host .env, prisma-at-runtime gotcha)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -9,8 +9,15 @@ user-facing overview.
 
 - **Garden** — Plant registry + care/harvest logs, plant **groups**, reusable
   **PlantType** records, Wikipedia photos. Plants sit on the shared location tree.
-- **Inventory** — durable **Item**s that nest (`parentItemId`), with **Label**s
-  (M:N via `LabelOnItem`), `ItemAttachment`, and `ItemLog`. Shares the Location spine.
+- **Inventory** — durable **Item**s that nest (`parentItemId`: a toolbox is an
+  Item that holds Items, with a cycle guard), with **Label**s (M:N via
+  `LabelOnItem`), `ItemAttachment` (PHOTO/MANUAL/RECEIPT/WARRANTY), and `ItemLog`.
+  Items carry value/purchase/warranty (incl. `lifetimeWarranty`, `insured`),
+  `serial`/`modelNumber`/`brand`, a **sold** lifecycle, and freeform `customFields`
+  (JSON, e.g. VIN). Maintenance = a `Task` linked via `Task.itemId`. **HomeBox CSV
+  import** at `/api/v1/items/import` (pure parser `src/lib/inventory/homebox-import.ts`).
+  `kind` is DURABLE|CONSUMABLE — consumable/Pantry is unbuilt (fields present so it
+  needs no migration). Shares the Location spine.
 - **Animals** — `Animal` + `AnimalLog` (pets/livestock); placed on the Location
   tree, and `Task`s can link to an animal (`Task.animalId`).
 - **Locations** — `Location` tree (self-ref `parentId`) shared by plants, items, animals.
@@ -20,6 +27,39 @@ user-facing overview.
 - **Backup & Restore** — `/api/admin/backup` + `/api/admin/restore` (admin only).
 - **Self-update** — admin "Pull & rebuild" (see Deploy).
 
+## Data model (the one rule)
+
+**Two nesting worlds, crossed once.** *Places* (`Location`, self-ref `parentId`,
+unlimited depth — `LocationKind` is an icon hint, never a constraint) nest in
+places. *Items* (things you own) nest in items, and an Item lives in a Place **or**
+inside another Item. You never put a Place inside an Item. **Plants** and
+**Animals** are leaves in a Place (own logs, don't nest). HomeBox + Grocy + farmOS
+collapse into: **Places · Plants/Animals (leaves) · Items (durable + consumable,
+nesting)**. Logs are per-domain tables (`PlantLog`/`ItemLog`/`AnimalLog`), NOT a
+polymorphic table; `Task` carries nullable `plantId`/`itemId`/`animalId`.
+
+## Architecture conventions
+
+- **API-first.** New modules (Inventory, Animals) are built on `/api/v1/*` and the
+  UI calls those same endpoints — no separate UI routes. Garden/Tasks predate this
+  and still use `/api/plants` etc.
+- **Service layer** `src/lib/services/*` does DB work + AuditEvent, taking
+  `(ctx: AuthContext, input)`. Routes are thin: `authenticateRequest(req, scope)` →
+  service → `handleApiError`. The MCP server (unbuilt) will reuse these services.
+- **Auth helper** `src/lib/api/authenticate.ts` accepts EITHER a NextAuth cookie
+  session (full scope `["*"]`) OR a Bearer PAT (limited to its `scopes`; write
+  implies read). Scope constants in `src/lib/api/scopes.ts` (client-safe).
+- **Decimals** for money/quantity (`@db.Decimal`) — convert to `Number()` before
+  passing to client components (Prisma Decimal isn't serializable across the boundary).
+
+## Blocked on a domain + HTTPS (deferred)
+
+Camera scanning/photo-capture (`getUserMedia` needs a secure context), the **PWA**
+(service worker + install need HTTPS), and the **MCP server** (Claude needs a public
+HTTPS URL) all wait until there's a domain + reverse-proxy/tunnel. The app is
+LAN-only over `http://NAS:8053` today. Pantry/consumables and other pure web work
+can ship before then.
+
 ## Local dev
 
 - DB: `postgresql://tonym@localhost:5432/moonbase_dev`; copy `.env.example` → `.env`.
@@ -31,6 +71,9 @@ user-facing overview.
 
 ## Deploy — git checkout on the NAS (NOT rsync)
 
+> Working without this file (e.g. a Claude on another machine)? The self-contained
+> version is `docs/git-deploy-guide.md`.
+
 The NAS appdata (`/mnt/user/appdata/moonbase`) is a real **git checkout** tracking
 `origin/master` (remote URL carries the token). Deploy by: