docs(runbook): tg-digest VDS deploy runbook + stack artifacts (task:1311)

Ранбук первого деплоя паттерна sched+worker (модель для yt-digest): стек tg-digest (воркер internal, mem_limit 256m), runtime-регистрация задачи POST /tasks, env-контракт, smoke/verify/rollback, gotchas (сессия Telethon, TZ UTC, timeoutMs). Артефакты: compose source-of-truth, Dockerfile + http_worker.py (черновики для коммита в victor/tg-digest). task:1311 разблокирован (1305 done) -> ready.

host-stacks/vds-kzntsv/tg-digest.compose.yml

@@ -0,0 +1,52 @@
+# tg-digest — HTTP-воркер дневного дайджеста телеграм-каналов.
+# sched cron 0 5 * * * (tz UTC = 08:00 MSK), runner http, simple mode.
+# Internal: сеть proxy, БЕЗ traefik-labels — наружу не публикуется (см. ранбук tg-digest-vds-deploy-runbook).
+# Deploy: Portainer-managed (см. portainer-stack-management-vds). Env через Portainer (не env_file).
+# Image: registry.kzntsv.site/tg-digest-worker:<tag> (python:3.13-alpine, telethon+requests, из main victor/tg-digest).
+
+services:
+  tg-digest:
+    image: registry.kzntsv.site/tg-digest-worker:<tag>
+    container_name: tg-digest
+    restart: unless-stopped
+    mem_limit: 256m
+    networks:
+      - proxy
+    environment:
+      # MTProto (оператор; pass telegram/api-id + api-hash)
+      TG_API_ID: ${TG_API_ID}
+      TG_API_HASH: ${TG_API_HASH}
+      TG_SESSION: /data/session.session
+      TG_PHONE: ${TG_PHONE}
+      TG_CACHE: /data/tg-cache
+      TG_WINDOW_HOURS: ${TG_WINDOW_HOURS:-24}
+      # Доставка (pass telegram/full-env)
+      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN}
+      TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID}
+      # Стадия-2 LLM (deepseek; ключ — у оператора)
+      LLM_API_KEY: ${LLM_API_KEY}
+      LLM_BASE_URL: ${LLM_BASE_URL:-https://api.deepseek.com}
+      LLM_MODEL: ${LLM_MODEL:-deepseek-chat}
+      # Ингест raw в mappa (pass mappa/full-env)
+      MAPPA_URL: ${MAPPA_URL:-https://mappa.vds.kzntsv.site}
+      MAPPA_API_TOKEN: ${MAPPA_API_TOKEN}
+      MAPPA_PROJECT: ${MAPPA_PROJECT:-tg-digest}
+      # Auth sched → воркер (pass sched/tg-digest-api-key)
+      WORKER_API_KEY: ${WORKER_API_KEY}
+      # 0 — dry-run smoke без отправки в TG
+      TG_SEND: ${TG_SEND:-1}
+    volumes:
+      - tg-digest-data:/data
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request;urllib.request.urlopen('http://127.0.0.1:8080/healthz')"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+
+volumes:
+  tg-digest-data:
+
+networks:
+  proxy:
+    external: true