Align README and running-the-server.md with the Docker-only policy (B-44)

CLAUDE.md declares the server always runs via Docker (dev and prod
alike) with no supported bare-uvicorn workflow, but README's Quick
start and docs/running-the-server.md's "Locale / venv" section still
documented running uvicorn directly — a leftover from before that
policy was adopted. Rewrite both to a single Docker-only path and
update CLAUDE.md's own note about it.

Verified docker compose run --rm app python scripts/generate_master_key.py
against a real build/run to confirm the Quick start's Docker commands
actually work as documented.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -13,33 +13,30 @@ production-ready.
 
 ## Quick start
 
+The server always runs via Docker (app + Caddy reverse proxy with automatic
+TLS) — in dev and production alike, with only `SITE_ADDRESS` differing
+between the two. There's no supported way to run `uvicorn` directly; the
+venv is only for local tooling (tests, Alembic migrations, the one-time key
+scripts) — see [CLAUDE.md](CLAUDE.md#commands).
+
 ```bash
 cp .env.example .env               # then fill in the generated secrets, see docs/setup.md
-python3 -m venv .venv && source .venv/bin/activate
-pip install -e ".[dev]"
-PYTHONPATH=. python scripts/generate_master_key.py
-alembic upgrade head
-uvicorn app.main:app --reload --port 8123
-```
-
-Open `http://127.0.0.1:8123/` for the test UI, `http://127.0.0.1:8123/admin`
-for the admin dashboard. The interactive API docs at `/docs` are disabled by
-default (they'd otherwise expose the whole API surface, admin endpoints
-included) — set `ENABLE_API_DOCS=true` in `.env` for local development to
-enable them.
-
-Or run the whole stack (app + Caddy reverse proxy with automatic TLS) via
-Docker:
-
-```bash
 mkdir -p data/db data/keys data/logs
 docker compose run --rm app python scripts/generate_master_key.py
 docker compose up -d --build
 ```
 
+Open `https://localhost/` for the test UI, `https://localhost/admin` for the
+admin dashboard (a self-signed-certificate warning on first visit is
+expected in dev — accept it, or use `curl -k`). The interactive API docs at
+`/docs` are disabled by default (they'd otherwise expose the whole API
+surface, admin endpoints included) — set `ENABLE_API_DOCS=true` in `.env` to
+enable them.
+
 See [docs/setup.md](docs/setup.md) and
 [docs/running-the-server.md](docs/running-the-server.md) for the full
-walkthrough (both workflows, dev vs. production TLS).
+walkthrough (secrets, master key generation, production TLS with a real
+domain).
 
 ## Documentation
 
@@ -64,7 +61,7 @@ python -m pytest                    # all tests
 python -m pytest tests/unit/test_hd.py   # one file
 ```
 
-76 unit tests cover HD derivation, PSBT building, the Electrum client, bets,
+232 unit tests cover HD derivation, PSBT building, the Electrum client, bets,
 deposits, withdrawals, the round/draw engine, RBF fee-bumping, admin config,
 the pending-inclusive balance calculation, and the SSE push channel. No
 automated integration tests against a live Electrum connection — mainnet