feat: native OAuth login page, architecture docs, docs site update

- Add GET/POST /login to hermes for first-party cookie during OAuth popup
  (fixes browser CHIPS cookie partitioning that broke claude.ai connection)
- Add role column to all findCustomer* SQL queries in src/auth.ts
- Add claude.ai tab to docs/getting-started.html with OAuth flow steps
- Add ARCHITECTURE.md with system diagrams, data flow, and key invariants
- Rewrite README.md and DEPLOY.md to reflect actual MicroK8s deployment
- Deploy updated docs site (squaremcp-docs sha256 updated)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/billing/middleware.ts

@@ -11,6 +11,7 @@ export interface Customer {
   plan: PlanKey;
   active: boolean;
   email: string;
+  role: string;
   // Credential loader — tool handlers call this to get their platform credentials
   getCredential: <T extends PlatformCredentials>(platform: Platform) => Promise<T | null>;
 }
@@ -20,6 +21,7 @@ interface CustomerRow extends RowDataPacket {
   plan: PlanKey;
   active: boolean;
   email: string;
+  role: string;
 }
 
 function buildCustomer(row: CustomerRow): Customer {
@@ -28,6 +30,7 @@ function buildCustomer(row: CustomerRow): Customer {
     plan: row.plan,
     active: Boolean(row.active),
     email: row.email,
+    role: row.role || 'user',
     getCredential: <T extends PlatformCredentials>(platform: Platform) =>
       getCredential<T>(row.id, platform),
   };