docs(selfhost): define safe update and rollback flow

[JSONbored]

Parent: #1819

Context

Maintainers need a normal update path that does not require custom one-off commands and does not overwrite local .env, private repo rules, auth volumes, local data, Grafana state, or compose overrides.

This issue defines and validates the day-two operator flow for updating from main now and from official image tags after release.

Requirements

• Document the source-checkout update path for the current maintainer deployment.
• Document the image-tag update path for released self-host images.
• Preserve .env, gittensory-config/, data volumes, Codex/Claude auth material, Grafana state, backup state, and optional local docker-compose.override.yml.
• Define when only the app service needs to restart versus when optional profile services should be recreated.
• Include migration and rollback expectations, especially when migrations are not reversible.
• Include preflight checks before update and post-update health checks after update.
• Keep commands copy/pasteable and safe for normal operators.

Deliverables

• Website docs page or section for update, rollback, and deploy hygiene.
• A concise operator checklist for: pull/sync, build or pull image, restart service, check /ready, inspect logs, verify release id.
• Clear warning about which files/directories are operator-owned and must never be overwritten by updates.
• Optional script or make target if it improves repeatability without hiding critical steps.

Acceptance criteria

• A maintainer can update the source-backed deployment without bespoke manual edits.
• A future image-based operator can update by changing/pulling a tag and recreating the app service.
• Private config, secrets, auth volumes, and data volumes remain untouched by the documented flow.
• Rollback guidance is explicit about image rollback versus database migration rollback limits.

Validation

• Run the documented flow against a non-production or disposable stack where practical.
• Verify the app reports the expected release/version after update.
• Verify docs build and relevant self-host tests still pass.

Ownership

Maintainer-only. No gittensor:* labels.