feat: native OAuth login page, architecture docs, docs site update

- Add GET/POST /login to hermes for first-party cookie during OAuth popup
  (fixes browser CHIPS cookie partitioning that broke claude.ai connection)
- Add role column to all findCustomer* SQL queries in src/auth.ts
- Add claude.ai tab to docs/getting-started.html with OAuth flow steps
- Add ARCHITECTURE.md with system diagrams, data flow, and key invariants
- Rewrite README.md and DEPLOY.md to reflect actual MicroK8s deployment
- Deploy updated docs site (squaremcp-docs sha256 updated)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/getting-started.html

@@ -53,12 +53,39 @@
   <h2>Step 2 — Configure your MCP client</h2>
 
   <div class="tabs">
-    <button class="tab active" onclick="switchTab(this,'claude')">Claude Desktop</button>
+    <button class="tab active" onclick="switchTab(this,'claudeai')">claude.ai</button>
+    <button class="tab" onclick="switchTab(this,'claude')">Claude Desktop</button>
     <button class="tab" onclick="switchTab(this,'codex')">Codex CLI</button>
     <button class="tab" onclick="switchTab(this,'opencode')">opencode</button>
   </div>
 
-  <div id="tab-claude" class="tab-content tab-panel active">
+  <div id="tab-claudeai" class="tab-content tab-panel active">
+    <p>Connect SquareMCP directly inside the claude.ai web interface — no config files needed.</p>
+    <ol class="steps">
+      <li><div><strong>Open MCP Servers</strong> — go to <strong>claude.ai → Settings → MCP Servers</strong> and click <strong>Add</strong>.</div></li>
+      <li><div><strong>Enter the server URL</strong></div></li>
+    </ol>
+<pre><code>https://hermes.squaremcp.com</code></pre>
+    <ol class="steps" start="3">
+      <li>
+        <div>
+          <strong>Complete the OAuth flow</strong> — a popup will open at <code>hermes.squaremcp.com/login</code>.
+          Sign in with your SquareMCP account credentials. After signing in you will be shown a consent page — click <strong>Connect MCP client</strong>.
+          The popup closes and the connector shows as <strong>Connected</strong>.
+        </div>
+      </li>
+    </ol>
+    <div class="callout">
+      <strong>Why a separate login page?</strong>
+      Browsers partition cookies per top-level site. The OAuth popup runs on <code>hermes.squaremcp.com</code>, so your session must be established there — not on <code>app.squaremcp.com</code> — for the cookie to be visible.
+    </div>
+    <h3>Troubleshooting claude.ai connections</h3>
+    <p><strong>Popup doesn't open</strong> — make sure your browser isn't blocking pop-ups from claude.ai. Allow pop-ups for claude.ai and retry.</p>
+    <p><strong>Stuck on login after connecting</strong> — the popup may have been closed before the OAuth flow finished. Remove the server entry, click Add again, and complete the full popup flow.</p>
+    <p><strong>Shows connected but tools don't appear</strong> — start a new conversation. Tools from newly connected MCP servers appear in the next conversation's tool picker.</p>
+  </div>
+
+  <div id="tab-claude" class="tab-content tab-panel">
 <pre><code><span class="cmt">// ~/Library/Application Support/Claude/claude_desktop_config.json  (macOS)</span>
 <span class="cmt">// %APPDATA%\Claude\claude_desktop_config.json                       (Windows)</span>
 {