feat: run TreatVault as a service image

README.md

@@ -10,17 +10,18 @@ TreatVault manages Barkstack's namespaced secrets. It keeps an age-encrypted sou
 - Consumers mount secrets at the stable target path `barkstack_<name>`; rotations swap the mounted source and update the service, leaving a rollback path.
 - Obsolete Barkstack-managed secret objects are deleted; objects still mounted by a managed service are reported in the sync status and refused for deletion via the API until their consumers are updated.
 
-## CLI
+## Service image
+
+TreatVault is a service, not a user CLI. `registry.campbellwireless.net/barkstack/treatvault:latest` runs its HTTP API on port `9090` inside the Barkstack overlay network. It accepts only service flags:
 
 ```sh
-treatvault keygen --identity ./treatvault-identity.txt
-treatvault init --file ./secrets.age --identity ./treatvault-identity.txt
-treatvault set --name database_password --file ./secrets.age --identity ./treatvault-identity.txt   # value on stdin
-treatvault list --file ./secrets.age --identity ./treatvault-identity.txt
-treatvault delete --name database_password --file ./secrets.age --identity ./treatvault-identity.txt
-treatvault serve --file ./secrets.age --identity ./treatvault-identity.txt --listen :9090
+treatvault --file /var/lib/treatvault/secrets.age \
+  --identity /run/secrets/barkstack_treatvault_identity \
+  --listen :9090
 ```
 
+On startup TreatVault creates the encrypted vault file when it is absent, using the mounted age identity. It then loads the file, reconciles Docker Swarm secrets, and exposes the API. The identity remains a Docker secret; TreatVault never exposes it through the API or UI.
+
 ## HTTP API
 
 - `GET /barkstack/ui/manifest.json` - Barkstack plugin manifest (id `treatvault`, mount `/treatvault`).
@@ -31,7 +32,7 @@ treatvault serve --file ./secrets.age --identity ./treatvault-identity.txt --lis
 
 ## Barkstack deployment
 
-Add a `treatvault` block to the Barkfile and run `barkstack init` on a Swarm manager:
+Configure TreatVault in the Barkfile and run `barkstack init` on a Swarm manager:
 
 ```text
 treatvault {
@@ -40,12 +41,12 @@ treatvault {
 }
 ```
 
-`barkstack init` provisions the `barkstack-treatvault` service (manager-constrained) with the encrypted file bind-mounted read-write at its host path, the Docker socket, the `barkstack_treatvault_identity` secret mounted at `/run/secrets/barkstack_treatvault_identity`, and no published ports; the console reaches it over the overlay network at `:9090`.
+`barkstack init` creates `barkstack_treatvault_identity` if absent, provisions the manager-constrained `barkstack-treatvault` service, and bind-mounts the encrypted file read-write at its configured host path. The service receives only that file, the Docker socket, and its Docker-secret identity; it has no published ports. The console reaches it over the overlay network at `:9090`.
+
+The encrypted file is safe to commit and back up. Keep its mounted Docker-secret identity outside source control. Use the TreatVault page in the Barkstack Console to create, rotate, and delete secret values; values are write-only and never returned.
 
 Services that consume vault secrets carry the `io.barkstack.treatvault.secrets=true` label plus an `io.barkstack.treatvault.names` label listing the logical names they need; `barkstack init` labels the PawSQL service automatically. Each sync mounts the current revision at the stable `/run/secrets/barkstack_<name>` target, so consumers read the same path across rotations.
 
-The Barkstack console automatically gains a TreatVault page (plugin id `treatvault`) for creating, rotating, and deleting secrets. Deletion is refused with `409 Conflict` while a labeled service still mounts the secret.
-
 ## Build
 
 ```sh