Update docs for Docker-on-deimos deployment, add grpc_plain_addr option

- ARCHITECTURE.md: document nginx + direct gRPC topology, add
  grpc_plain_addr config, update cert filenames to Let's Encrypt
  convention, add passwd to CLI table
- RUNBOOK.md: replace systemctl/journalctl with docker commands,
  fix cert path references, improve sync troubleshooting steps
- Example config: update cert paths, document grpc_plain_addr option
- grpcserver: add optional plaintext gRPC listener for reverse proxy
- config: add GRPCPlainAddr field

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -18,10 +18,11 @@ type Config struct {
 }
 
 type ServerConfig struct {
-	ListenAddr string `toml:"listen_addr"`
-	GRPCAddr   string `toml:"grpc_addr"`
-	TLSCert    string `toml:"tls_cert"`
-	TLSKey     string `toml:"tls_key"`
+	ListenAddr      string `toml:"listen_addr"`
+	GRPCAddr        string `toml:"grpc_addr"`
+	GRPCPlainAddr   string `toml:"grpc_plain_addr"`
+	TLSCert         string `toml:"tls_cert"`
+	TLSKey          string `toml:"tls_key"`
 }
 
 type WebConfig struct {