Update CLAUDE.md, MkDocs, nginx docs proxy, .claude/rules

- CLAUDE.md: Comprehensive documentation for core infrastructure
- docs-src: Cleaned 316MB junk, kept only markdown docs
- mkdocs.yml: Updated nav for core-only content
- nginx: Docs proxy targets split (3002->lehrer, 3007->compliance)
- docker-compose: Fixed docs port mapping (8009:80), added INSTALL_LOCK
- .claude/rules: testing, documentation, open-source-policy, night-scheduler

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -681,6 +681,7 @@ services:
       GITEA__service__REQUIRE_SIGNIN_VIEW: "true"
       GITEA__repository__DEFAULT_BRANCH: main
       GITEA__log__LEVEL: Warn
+      GITEA__security__INSTALL_LOCK: "true"
       GITEA__webhook__ALLOWED_HOST_LIST: "*"
     extra_hosts:
       - "macmini:192.168.178.100"
@@ -810,9 +811,9 @@ services:
     profiles: [docs]
     platform: linux/arm64
     ports:
-      - "8009:8009"
+      - "8009:80"
     healthcheck:
-      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8009/"]
+      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:80/"]
       interval: 30s
       timeout: 10s
       retries: 3