Without a host mount, the bundled mkcert regenerates CAROOT on every
container recreate while the cert cache survives in /data, leaving the
cached leaf chained to a CA that no longer exists. Strengthen the Docker
section to call this out and add a dedicated Troubleshooting entry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>