Update docs for Docker-on-deimos deployment, add grpc_plain_addr option

- ARCHITECTURE.md: document nginx + direct gRPC topology, add
  grpc_plain_addr config, update cert filenames to Let's Encrypt
  convention, add passwd to CLI table
- RUNBOOK.md: replace systemctl/journalctl with docker commands,
  fix cert path references, improve sync troubleshooting steps
- Example config: update cert paths, document grpc_plain_addr option
- grpcserver: add optional plaintext gRPC listener for reverse proxy
- config: add GRPCPlainAddr field

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/examples/eng-pad-server.toml

@@ -1,8 +1,9 @@
 [server]
-listen_addr = ":8443"
-grpc_addr   = ":9443"
-tls_cert    = "/srv/eng-pad-server/certs/cert.pem"
-tls_key     = "/srv/eng-pad-server/certs/key.pem"
+listen_addr     = ":8443"
+grpc_addr       = ":9443"
+# grpc_plain_addr = "127.0.0.1:9444"  # Optional: plaintext gRPC for reverse proxy
+tls_cert        = "/srv/eng-pad-server/certs/fullchain.pem"
+tls_key         = "/srv/eng-pad-server/certs/privkey.pem"
 
 [web]
 listen_addr = ":8080"