docs: add autonomous server installation guide

scripts/test-verify-workspace-install-docs.sh

@@ -15,7 +15,11 @@ for fixture in \
   "source update fail-closed semantics" \
   "Windows line-ending recovery guide contract" \
   "Pi management guide contract" \
+  "server installation guide contract" \
+  "Nginx reverse-proxy guide contract" \
+  "Caddy reverse-proxy guide contract" \
   "local installation example rendered from path with spaces" \
+  "server installation example rendered from path with spaces" \
   "local manual canonical base+override references" \
   "server manual canonical base+override references" \
   "canonical local base+override fixture" \
@@ -29,9 +33,7 @@ for fixture in \
   }
 done
 
-for manual in \
-  "$root/docs/install/local-workspace-registry.md" \
-  "$root/docs/install/server-workspace-registry.md"; do
+for manual in "$root/docs/install/local-workspace-registry.md"; do
   grep -Fq 'export THT_SOURCE_ROOT=/absolute/path/to/ThothII' "$manual" || {
     echo "installation manual does not publish a self-contained THT_SOURCE_ROOT export: $manual" >&2
     exit 1
@@ -46,6 +48,17 @@ for manual in \
   fi
 done
 
+grep -Fq 'THTCTL=/srv/thothii/operator/thothctl' \
+  "$root/docs/install/server-workspace-registry.md" || {
+  echo "server installation manual does not use the installation-aware operator CLI" >&2
+  exit 1
+}
+grep -Fq 'INSTALLATION=/srv/thothii/operator/thothii-installation.yaml' \
+  "$root/docs/install/server-workspace-registry.md" || {
+  echo "server installation manual does not identify the server installation descriptor" >&2
+  exit 1
+}
+
 if rg -n 'local-compose\.workspace-registry|server-compose\.workspace-registry|connector-secrets\.workspace-registry|docker compose' \
   "$root/docs/install/local-workspace-registry.md" \
   "$root/docs/install/server-workspace-registry.md"; then
@@ -92,6 +105,33 @@ switch (mutation) {
   case "raw-pi":
     changed += "\n```sh\ndocker compose exec core pi --version\n```\n";
     break;
+  case "server-secret-env":
+    changed += "\n```dotenv\nTHT_MODEL_API_KEY=unsafe-secret-value\n```\n";
+    break;
+  case "server-docker-socket":
+    changed += "\nMount /var/run/docker.sock into core for management.\n";
+    break;
+  case "server-coupling":
+    changed += "\nAttach core to the omics_portal application network.\n";
+    break;
+  case "nginx-no-auth":
+    changed = original.replace("        auth_request /_authenticate;", "        # authentication omitted");
+    break;
+  case "nginx-core-upstream":
+    changed = original.replaceAll("http://127.0.0.1:8080", "http://127.0.0.1:8787");
+    break;
+  case "nginx-no-sse":
+    changed = original.replace("        proxy_buffering off;", "        proxy_buffering on;");
+    break;
+  case "caddy-no-auth":
+    changed = original.replace("forward_auth auth-gateway:4180 {", "# forward authentication omitted");
+    break;
+  case "caddy-client-identity":
+    changed = original.replace("X-Thoth-Principal-Subject>X-Thoth-Trusted-Principal-Subject", "X-Thoth-Principal-Subject");
+    break;
+  case "caddy-core-upstream":
+    changed = original.replaceAll("127.0.0.1:8080", "127.0.0.1:8787");
+    break;
   case "dirty-source":
     changed = original.replaceAll("git status --porcelain --untracked-files=all", "git status --short");
     break;
@@ -163,6 +203,42 @@ expect_guide_rejected \
   "raw non-installation-aware Pi access" verify_pi_management_guide \
   "$root/docs/install/pi-management.md" docs/install/pi-management.md raw-pi \
   "raw non-installation-aware Compose Pi access is forbidden"
+expect_guide_rejected \
+  "server secret in environment" verify_server_guide \
+  "$root/docs/install/server.md" docs/install/server.md server-secret-env \
+  "server installation guide embeds a secret value"
+expect_guide_rejected \
+  "server Docker socket mount" verify_server_guide \
+  "$root/docs/install/server.md" docs/install/server.md server-docker-socket \
+  "server installation guide introduces a Docker socket dependency"
+expect_guide_rejected \
+  "server application coupling" verify_server_guide \
+  "$root/docs/install/server.md" docs/install/server.md server-coupling \
+  "server installation guide introduces forbidden application coupling"
+expect_guide_rejected \
+  "Nginx identity without authentication" verify_reverse_proxy_nginx_guide \
+  "$root/docs/install/reverse-proxy-nginx.md" docs/install/reverse-proxy-nginx.md nginx-no-auth \
+  "Nginx proxy lacks structural token: auth_request /_authenticate;"
+expect_guide_rejected \
+  "Nginx direct core exposure" verify_reverse_proxy_nginx_guide \
+  "$root/docs/install/reverse-proxy-nginx.md" docs/install/reverse-proxy-nginx.md nginx-core-upstream \
+  "Nginx proxy must forward only to frontend on 127.0.0.1:8080"
+expect_guide_rejected \
+  "Nginx buffered SSE" verify_reverse_proxy_nginx_guide \
+  "$root/docs/install/reverse-proxy-nginx.md" docs/install/reverse-proxy-nginx.md nginx-no-sse \
+  "Nginx proxy lacks structural token: proxy_buffering off;"
+expect_guide_rejected \
+  "Caddy identity without authentication" verify_reverse_proxy_caddy_guide \
+  "$root/docs/install/reverse-proxy-caddy.md" docs/install/reverse-proxy-caddy.md caddy-no-auth \
+  "Caddy proxy lacks structural token: forward_auth auth-gateway:4180 {"
+expect_guide_rejected \
+  "Caddy untrusted identity forwarding" verify_reverse_proxy_caddy_guide \
+  "$root/docs/install/reverse-proxy-caddy.md" docs/install/reverse-proxy-caddy.md caddy-client-identity \
+  "Caddy proxy lacks structural token: X-Thoth-Principal-Subject>X-Thoth-Trusted-Principal-Subject"
+expect_guide_rejected \
+  "Caddy direct core exposure" verify_reverse_proxy_caddy_guide \
+  "$root/docs/install/reverse-proxy-caddy.md" docs/install/reverse-proxy-caddy.md caddy-core-upstream \
+  "Caddy proxy must forward only to frontend on 127.0.0.1:8080"
 
 expect_guide_rejected \
   "dirty or untracked source tree" verify_local_guide \