Document the Phase 15 deploy and ungate the Spanish pair

deploy/README.md becomes the real runbook: the VPS stack, Traefik, the
headscale LLM link, the interim edge gate, backups and restore. The
millenia Piper notes move to an appendix -- that instance still runs
them, and it is still canonical.

Two items are called out as outstanding rather than done, because both
need access to millenia: vLLM is not bound to its headscale interface,
so no AI pass works from the VPS yet, and parodia's ssh key is not
authorized there, so backups are VPS-local only -- which is not a backup
in the sense that matters. Each has its one-command fix written down.

Also folds in DreamDict gaining Spanish: es was explicitly gated on that
dataset existing, so it moves from "Later / not now" to a normal
follow-on pair after pt-PT, and the Phase 20 provider seam should cover
it from the start.

README.md

@@ -32,6 +32,16 @@ cd .. && go build -o petal ./cmd/server
 
 Configuration is via environment variables — copy `.env.example` to `.env`.
 
+## Deployment
+
+```bash
+docker compose up -d --build     # petal + the two Piper read-aloud sidecars
+```
+
+Behind Traefik on the parodia.dev VPS; vLLM stays on millenia over headscale.
+Full runbook — first deploy, the LLM link, backups and restore — in
+[`deploy/README.md`](./deploy/README.md).
+
 ## Status
-Early build, multi-session. Auth (Authentik), Copyleaks plagiarism, and Docker/Traefik
-deployment are deferred — see `BUILD_PLAN.md`.
+Early build, multi-session. Auth (Authentik OIDC) is next; Copyleaks plagiarism is
+still parked — see `BUILD_PLAN.md`.