Update docs for Docker-on-deimos deployment, add grpc_plain_addr option

- ARCHITECTURE.md: document nginx + direct gRPC topology, add
  grpc_plain_addr config, update cert filenames to Let's Encrypt
  convention, add passwd to CLI table
- RUNBOOK.md: replace systemctl/journalctl with docker commands,
  fix cert path references, improve sync troubleshooting steps
- Example config: update cert paths, document grpc_plain_addr option
- grpcserver: add optional plaintext gRPC listener for reverse proxy
- config: add GRPCPlainAddr field

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/eng-pad-server/server.go

@@ -50,11 +50,12 @@ func runServer(cmd *cobra.Command, args []string) error {
 
 	// Start gRPC server
 	grpcSrv, err := grpcserver.Start(grpcserver.Config{
-		Addr:    cfg.Server.GRPCAddr,
-		TLSCert: cfg.Server.TLSCert,
-		TLSKey:  cfg.Server.TLSKey,
-		DB:      database,
-		BaseURL: cfg.Web.BaseURL,
+		Addr:      cfg.Server.GRPCAddr,
+		PlainAddr: cfg.Server.GRPCPlainAddr,
+		TLSCert:   cfg.Server.TLSCert,
+		TLSKey:    cfg.Server.TLSKey,
+		DB:        database,
+		BaseURL:   cfg.Web.BaseURL,
 	})
 	if err != nil {
 		return fmt.Errorf("start grpc: %w", err)