docs(hephaestus.x): cross-link gotchas + worked example for publishing an app image

Parallel session had to synthesize two things the page should have handed
them upfront. Fixing that:

- §11 (Gotchas) now links from each entry to its full-recipe section:
  HTTPS+PAT → §5+§6, em-dash mojibake → §8, admin-rename → §4. New leading
  entry explicitly separates 'PAT vs wallet passphrase' since it's the most
  common wallet-flow confusion.
- §7 (Container registry) gets a 'Worked example: publish an app's backend as
  an image' subsection — Node/alpine Dockerfile + build+push pair, so the
  next reader doesn't have to compose it from the Log-in and Push blocks.

Follow-up to cc544c8.

hephaestus.x/docs/index.html

@@ -272,6 +272,23 @@ docker push code.silentmode.st/&lt;owner&gt;/&lt;image&gt;:&lt;tag&gt;</pre>
     <h4>List packages</h4>
     <pre>curl https://code.silentmode.st/api/v1/packages/&lt;owner&gt;?type=container</pre>
 
+    <h4>Worked example: publish an app's backend as an image</h4>
+    <p>Any backend that runs in a container publishes the same way. Node example — Dockerfile at the repo root:</p>
+    <pre><span class="cm"># Dockerfile</span>
+FROM node:20-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --production
+COPY . .
+EXPOSE 8080
+CMD ["node", "server.js"]</pre>
+    <p>Build + push in one pass:</p>
+    <pre>docker login code.silentmode.st -u &lt;you&gt;
+<span class="cm"># password: PAT with write:package scope (see §6)</span>
+docker build -t code.silentmode.st/&lt;owner&gt;/&lt;app&gt;:latest .
+docker push code.silentmode.st/&lt;owner&gt;/&lt;app&gt;:latest</pre>
+    <p>The image is now pullable at <code>code.silentmode.st/&lt;owner&gt;/&lt;app&gt;:latest</code>. If the repo is public, Flux + friends can pull it anonymously (§7 above). Verify it in <a href="https://code.silentmode.st/-/packages">/-/packages</a> or via the list-packages API.</p>
+
     <h2 id="api">8. API basics</h2>
     <p>Full Swagger at <a href="https://code.silentmode.st/api/swagger">code.silentmode.st/api/swagger</a>. Auth is a token in a header:</p>
     <pre>curl -H "Authorization: token $TOKEN" https://code.silentmode.st/api/v1/user
@@ -319,11 +336,12 @@ open https://your-domain.example/user/oauth2/hephaestus-wallet</pre>
 
     <h2 id="gotchas">11. Known gotchas</h2>
     <ul>
+      <li><b>Push over HTTPS asks for a password.</b> That password is a <b>Personal Access Token</b>, not your wallet passphrase. Wallet passphrases decrypt the wallet in your browser's <code>localStorage</code>; they have nothing to do with Forgejo's git auth. See <a href="#repos">§5</a> for the git-remote URL and <a href="#tokens">§6</a> for how to generate the PAT.</li>
+      <li><b>Descriptions show as <code><EFBFBD></code></b> when shell → curl → API re-encodes UTF-8 as CP1252 (Windows Git Bash is the usual culprit). Use a Python <code>urllib</code> PATCH or <code>curl --data-binary @file</code>. Full recipe with the correct <code>Content-Type</code> header is in <a href="#api">§8 → "Encoding gotcha"</a>.</li>
       <li><b>Signature mismatch on <code>/auth/verify</code></b> almost always means your message string got a trailing newline (Python <code>print</code>, Bash heredoc). Write the message to a file with <code>newline=''</code> and hash the file bytes directly.</li>
       <li><b>OIDC callback URL uses port 3000</b> if Forgejo's <code>ROOT_URL</code> is unset. Setting <code>[server].ROOT_URL = https://code.silentmode.st/</code> in <code>app.ini</code> fixes it; browsers can't reach internal port 3000.</li>
       <li><b>Cross-origin session cookies.</b> Starting OAuth on hephaestus.x and finishing on code.silentmode.st loses the session cookie mid-flow. The landing dropdown always kicks off on code.silentmode.st to avoid this.</li>
-      <li><b>Renaming a user via admin API</b> takes <code>new_name</code> as a form field, not JSON. JSON returns 422 "NewName required".</li>
-      <li><b>Descriptions show as <code><EFBFBD></code></b> when shell → curl → API re-encodes UTF-8 as CP1252. Use a Python <code>urllib</code> PATCH or <code>curl --data-binary @file</code>.</li>
+      <li><b>Renaming a user via admin API</b> takes <code>new_name</code> as a form field, not JSON. JSON returns 422 "NewName required". Full command in <a href="#rename">§4 → "From the admin API"</a>.</li>
       <li><b>SSH port is 2222, not 22</b>, so the compose stack doesn't fight the host's sshd. Your git remote URL must include <code>:2222</code>.</li>
       <li><b>Docker Hub rate limits</b> can bite <code>docker compose build</code> if you're unauthenticated. Log in once with <code>docker login</code> against Docker Hub before running the stack build.</li>
     </ul>