fix: validate deployment rollback and server topology

docs/install/server.md

@@ -184,8 +184,17 @@ sudo -u thothii git -c core.autocrlf=false clone \
 cd /srv/thothii/source/ThothII
 sudo -u thothii git config --local core.autocrlf false
 bash scripts/verify-line-endings.sh
+sudo /srv/thothii/source/ThothII/scripts/prepare-server-pi-state.sh \
+  /srv/thothii/pi-state 10001 10001
 ```
 
+The last command is a mandatory clean-install and restore preflight. The server profile bind-mounts
+the writable Pi-state root and then overlays protected `auth.json` plus tracked `models.json` and
+`settings.json` read-only below it. Docker requires those three hidden target files to exist under
+the host parent bind before startup. The initializer creates them atomically with UID/GID 10001,
+mode `0600`, rejects symlink roots or targets, and never overwrites existing contents. It is safe to rerun
+after restoring `pi-state`; run it before any `thothctl start`, Compose render/start, or Pi update.
+
 Copy the path-only server environment and installation descriptor:
 
 ```sh
@@ -414,6 +423,11 @@ sudo test -d "$RESTORE/workspace-registry/repo"
 sudo test -d "$RESTORE/workspace-registry/snapshots"
 ```
 
+After placing the restored `pi-state` tree and before the first start, rerun
+`sudo /srv/thothii/source/ThothII/scripts/prepare-server-pi-state.sh /srv/thothii/pi-state 10001 10001`.
+It validates or recreates only the hidden regular mount targets; it does not alter restored Pi
+state or any protected configuration source.
+
 During the reviewed restore window, move each old tree to a timestamped sibling, move the matching
 restored tree into `/srv/thothii`, restore the PostgreSQL session backup from the same recovery
 point, and keep the proxy closed. Run `update --check-only`, `start`, `doctor`, `pi test`, registry