new tasks, devnet topup, cli, new model support

docs/DEPLOY_PORTAINER.md

@@ -43,13 +43,27 @@ ENABLE_BILLING_DB=1
 ```
 
 For first cloud-only test, use `CLUSTER_PEERS=`. Click **Deploy the stack**.
+(`ai.neuron.d-popov.com` is publicly reachable, so two-tracker sync works over the
+internet — but add it only after the cloud-only friends test proves out; two-peer
+Raft adds moving parts without fault tolerance.)
 
 `ENABLE_BILLING_DB=1` makes billing public behavior active: `/v1/chat/completions`
-requires `Authorization: Bearer <api-key>`. Any key is accepted and starts with
-the configured starter credit; calls return `402` after that balance is
+requires `Authorization: Bearer <sk-mesh-...>` — a real API key created through
+an account (register on `/dashboard`, then "+ new key"); arbitrary bearer
+strings are rejected with `401`. Calls return `402` once the key's balance is
 exhausted. Set `ENABLE_BILLING_DB=0` if existing unauthenticated clients must
 keep working during the first redeploy.
 
+Credit variables (US-039/US-040):
+
+```text
+STARTING_CREDIT=1      # one-time Caller Credit (USDT) on an account's first key
+DEVNET_TOPUP=1         # dashboard "+$N (devnet)" faucet button; 0 disables
+```
+
+Both default to **1** (devnet-friendly alpha). On any deployment holding a
+mainnet treasury set both to 0 — the faucet mints client balance for free.
+
 Optional Solana treasury settlement variables:
 
 ```text
@@ -94,7 +108,9 @@ Custom locations on the same proxy host:
 
 Leave sub-folder forwarding empty.
 
-If WebSockets fail, Advanced:
+**Required:** NPM custom locations do NOT inherit the proxy host's "Websockets
+Support" toggle. Paste this into the **Advanced** box of *each* custom location
+(`/ws` and `/rpc`), or every WebSocket handshake to the relay dies at nginx:
 
 ```nginx
 proxy_http_version 1.1;