chore: trips catch-up migration (0011) + docs for Komodo push-to-deploy

- prisma/migrations/0011_trips: trips table, trip_id on overrides, partial
  index — idempotent; matches DDL already applied to prod. Applied to
  personal_test (integration suite was failing on missing trips relation).
- README/CLAUDE.md: deployment is now push-to-deploy via Komodo
  (deploy-finance Procedure, Gitea webhook); compose command is fallback.
- README: migrations table completed through 0011; note that the container
  must only be reachable via Traefik (header-trust auth).

README.md

@@ -343,6 +343,10 @@ docker exec postgres-personal psql -U personal -d personal \
 | `0005_rules` | `rules` |
 | `0006_budgets` | `budgets` |
 | `0007_cashflow` | `amount_aud`, `exchange_rate_to_aud` on transactions; `exchange_rate_to_aud` on statements |
+| `0008_my_share_percent` | `my_share_percent` on `transaction_overrides` |
+| `0009_split_payments` | `split_payments` |
+| `0010_csv_import_reconcile` | `reconciled_with_id`, CSV import support |
+| `0011_trips` | `trips`, `trip_id` on `transaction_overrides` (catch-up — was applied directly) |
 
 > `paperless_doc_id` on statements and the `uq_statements_paperless_doc_id` index were added directly (not tracked in a migration file).
 > `owner_id` on transactions and `statement_id` made nullable were applied directly (March 2026) to support manual transaction entry without a fake statement.
@@ -371,7 +375,13 @@ Currently `merchant_normalized` conflates the *payment provider* with the *merch
 
 ## Deployment
 
-Runs as a Docker container alongside the rest of the home lab stack. Build and deploy:
+Runs as a Docker container alongside the rest of the home lab stack.
+
+**Push-to-deploy (default, since 2026-07-19)**: pushing to `main` on Gitea fires a
+webhook to Komodo's `deploy-finance` Procedure, which redeploys the `finance` stack
+with `--build`. CI (Gitea Actions) runs lint + unit tests on the same push.
+
+**Manual fallback** if Komodo is unavailable:
 
 ```bash
 # From smarthome repo root
@@ -379,4 +389,9 @@ docker compose --env-file docker/common.env --env-file docker/finance/.env \
   -f docker/finance/docker-compose.yml up -d --build
 ```
 
+The container is only reachable via Traefik (`https://finance.bosecamp.com`, forward-auth
+sets `X-Forwarded-User`) plus a `127.0.0.1`-bound host port for on-box debugging — the
+app trusts the `X-Forwarded-User` header, so it must never be directly reachable from
+the LAN.
+
 The container uses Next.js standalone output. `@prisma/adapter-pg` and `pg` are listed in `serverExternalPackages` in `next.config.ts` to ensure they are included in the standalone bundle.