chore: add restart-server.sh helper for fast minerva restarts

One-line wrapper around docker compose ... restart plus a /api/health
poll, useful after editing users.toml/settings.toml/.env on minerva
(boot-time read). docs/deployment.md updated (user-mgmt, troubleshooting,
TLS-proxy sections) to reference the wrapper instead of the inline
ssh+docker command.

docs/deployment.md

@@ -100,12 +100,15 @@ Adding or rotating a user means editing `users.toml` on minerva and
 restarting the container so the boot-time parser picks up the change:
 
 ```bash
-ssh minerva.lan
-docker run --rm -i doctate-server:latest hash-password   # silent prompt, prints hash
-nano /opt/stacks/doctate-server/config/users.toml        # paste the hash
-docker compose -f /opt/stacks/doctate-server/compose.yaml restart doctate-server
+ssh minerva.lan 'docker run --rm -i doctate-server:latest hash-password'
+ssh minerva.lan 'nano /opt/stacks/doctate-server/config/users.toml'
+./scripts/restart-server.sh
 ```
 
+`scripts/restart-server.sh` wraps the `docker compose ... restart` plus
+a `/api/health` poll, so you see in one line whether the new config is
+actually live or whether the server hit a boot-time error.
+
 The `users.toml` mount is read-only by design — the container is not
 allowed to modify the auth file. Edits happen on the host.
 
@@ -133,7 +136,7 @@ rollback — only the binary swaps.
 | Login refused on HTTPS | `COOKIE_SECURE` and TLS-proxy mismatch — see "TLS" section below |
 | File missing inside container | `docker compose -f /opt/stacks/doctate-server/compose.yaml exec doctate-server ls /app` |
 | Health-check status | `ssh minerva.lan 'docker inspect --format "{{.State.Health.Status}}" doctate-server'` |
-| Config edit not picked up | `docker compose ... restart doctate-server` — most config is read on boot, not per request |
+| Config edit not picked up | `./scripts/restart-server.sh` — most config is read on boot, not per request |
 | Stale image tag on minerva | `docker images --filter dangling=true` — retag or `docker image prune` |
 
 ## TLS / nginx reverse proxy
@@ -145,9 +148,8 @@ to `http://minerva.lan:3000`, set the cookie flag accordingly so
 browsers actually accept the session cookie:
 
 ```bash
-ssh minerva.lan
-echo 'COOKIE_SECURE=true' >> /opt/stacks/doctate-server/config/.env
-docker compose -f /opt/stacks/doctate-server/compose.yaml restart doctate-server
+ssh minerva.lan "echo 'COOKIE_SECURE=true' >> /opt/stacks/doctate-server/config/.env"
+./scripts/restart-server.sh
 ```
 
 Without this override under a TLS proxy, the login flow looks like it