feat(deploy): halkyon.li's first start, its .env made on the host (ADR 0039, D21)

first-start.md takes the instance from a bare host to running, once: the
sidecars' users, deploy with a read-only key to the forge and the
developer's keys (GPG for redeploy.sh's check, SSH pinned to it), .env,
SimpleLogin's app, the sidecars' folders and Jellyfin moved in, a role and
database for each app's server, the first start, the first operator by
ADR 0021's SQL, and the backups.

halkyon-li-env.sh writes .env with every secret made on the host and never
over an existing file, as the peppers must not change once people sign in:
SimpleLogin alone with approval, everything running behind the forward,
Train's map and routes over southern Bavaria and its search over Germany
until the Instance console cuts regions, Germany as where data and backups
are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0039-halkyon-li-at-home.md

@@ -198,6 +198,18 @@
   unlocking by SSH). dracut's last image stays in GRUB's menu, shown for 5 seconds, as
   the way back until initramfs-tools' images have booted, so a failed image costs a
   choice at the iMac rather than a USB stick.
+- **D21 The first start** (the developer's choices of 8 Nov 2026; the steps:
+  `deploy/host/first-start.md`). `.env` is written on balthasar by
+  `deploy/host/halkyon-li-env.sh`, every secret made there, never over an existing
+  file, and copied whole into Proton Pass (over rendering it from Proton Pass on
+  melchior at every change). Everything runs from the start: Jellyfin, LanguageTool,
+  BRouter, Train's map and place search beside the four servers. Until the console
+  cuts regions (ADR 0040), the map and routes cover southern Bavaria (the map
+  `10,47.2,13.9,49`, BRouter `10,45,15,50`) and the search Germany, the smallest
+  Photon's databases come in, with a 2 GB heap in 3 GB, as Europe's (45 GB of tiles
+  and twice that while refreshing, 32.6 GB for Photon with 6 to 8 GB of memory) fits
+  neither the HDD beside the 704 GB library nor the 7.2 GB of memory. The app says
+  Germany for the data and the backups (`DE`). Meditate starts without a library.
 
 ## Consequences