docs(selfhost): make beta onboarding image-first

[JSONbored]

Parent: #1936

Problem

The current self-host path is still too source-build oriented for external operators. Beta users should be able to pull a known image, copy one focused env file, mount config, and start the stack with sane defaults.

Requirements

• Make the default documented path image-first, not docker compose up --build first.
• Provide a focused self-host env example that is not mixed with Cloudflare Worker/local development settings.
• Ensure Redis-backed response caching and queue behavior have sane defaults.
• Keep advanced services opt-in: Postgres, pgbouncer, Qdrant, Ollama, Litestream, Caddy, observability, runners.
• Make AI providers explicit: Claude Code only, Codex only, or both.
• Keep unsafe/advanced Codex reviewer behavior gated and clearly documented.

Deliverables

• Image-first compose guidance for beta users.
• A clean self-host env example or clearly separated docs section.
• Updated quickstart docs covering first boot, health check, logs, and expected warnings.
• Explicit defaults table: enabled by default, disabled by default, recommended for production.

Acceptance criteria

• A fresh operator can start from image + env + config without reading internal deployment notes.
• Defaults do not require exposing unnecessary ports or enabling optional services.
• Claude Code and Codex subscription modes are each documented, including one-or-both configuration.
• SQLite is presented as trial/single-node default; Postgres is recommended for serious/high-volume installs.

Expected outcome

Early beta testers can launch the self-host stack predictably without accidentally enabling costly or risky features.

[linear-code]

JSO-2023