fix(demo): Dockerfile pnpm pin + remaining stoka/kayula sweep for Dokploy

The Dokploy deploy failed on `pnpm install --frozen-lockfile` because
`corepack prepare pnpm@latest` now resolves to pnpm v11+ which requires
Node v22 (uses node:sqlite). The base image is node:20-alpine.

Three deploy-blocking fixes:

1. Dockerfile — pin `pnpm@9.15.0` (matches pnpm-lock.yaml v9.0 schema we
   ship). Also rename the final binary stoka → gritdemo to match the
   module, add a non-root `grit` user with `chown -R grit:grit /app`
   BEFORE `USER grit` (so Sentinel/Pulse can create their SQLite stores
   — the "out of memory (14)" failure is SQLITE_CANTOPEN for permission-
   denied, not actually OOM).

2. docker-compose.yml — sweep the remaining stoka + kayula refs. The
   service block is now `gritdemo:` (was `stoka:`), Postgres user / DB
   default `${POSTGRES_USER:-gritdemo}` (was `kayula`), healthcheck
   updated to match.

3. DEPLOYMENT.md — every stoka.yourdomain.com → gritdemo.yourdomain.com,
   docker compose exec/log examples renamed, GitHub clone URL changed
   from MUKE-coder/stoka.git to MUKE-coder/grit.git (cd grit/demo).

The two IDE diagnostics flagged on the Dockerfile are CVEs in the
upstream base images (node:20-alpine + golang:1.24-alpine); they
predate this change and are unrelated.

Author: MUKE-coder

demo/DEPLOYMENT.md

@@ -18,7 +18,7 @@
 │  └────────────────────────────────┘  │
 │              │                       │
 │         Reverse Proxy (Traefik)      │
-│         stoka.yourdomain.com         │
+│         gritdemo.yourdomain.com         │
 └──────────────────────────────────────┘
            │
     Cloudflare R2 (images)
@@ -33,7 +33,7 @@ Single binary serves both API and frontend. PostgreSQL and Redis run as Docker s
 
 Ensure Dokploy is running on your VPS. You need:
 - Docker & Docker Compose
-- A domain pointed to your VPS IP (e.g., `stoka.yourdomain.com`)
+- A domain pointed to your VPS IP (e.g., `gritdemo.yourdomain.com`)
 
 ---
 
@@ -63,9 +63,9 @@ Edit `.env.production` with your real values:
 
 ```env
 # REQUIRED — change all of these:
-APP_URL=https://stoka.yourdomain.com
-FRONTEND_URL=https://stoka.yourdomain.com
-DATABASE_URL=postgres://stoka:YOUR_DB_PASSWORD@postgres:5432/stoka?sslmode=disable
+APP_URL=https://gritdemo.yourdomain.com
+FRONTEND_URL=https://gritdemo.yourdomain.com
+DATABASE_URL=postgres://gritdemo:YOUR_DB_PASSWORD@postgres:5432/gritdemo?sslmode=disable
 JWT_SECRET=YOUR_64_CHAR_SECRET
 INTERNAL_API_KEY=stk_prod_YOUR_KEY
 VITE_INTERNAL_API_KEY=stk_prod_YOUR_KEY    # Must match INTERNAL_API_KEY
@@ -76,7 +76,7 @@ R2_BUCKET=gritdemo-images
 RESEND_API_KEY=re_YOUR_KEY
 MAIL_FROM=noreply@yourdomain.com
 REDIS_URL=redis://:YOUR_REDIS_PASSWORD@redis:6379
-CORS_ORIGINS=https://stoka.yourdomain.com
+CORS_ORIGINS=https://gritdemo.yourdomain.com
 POSTGRES_PASSWORD=YOUR_DB_PASSWORD          # Must match DATABASE_URL
 REDIS_PASSWORD=YOUR_REDIS_PASSWORD          # Must match REDIS_URL
 ```
@@ -90,19 +90,19 @@ REDIS_PASSWORD=YOUR_REDIS_PASSWORD          # Must match REDIS_URL
 ### Option A: Deploy from GitHub (Recommended)
 
 1. In Dokploy, create a new **Compose** application
-2. Connect your GitHub repo: `https://github.com/MUKE-coder/stoka.git`
+2. Connect your GitHub repo: `https://github.com/MUKE-coder/grit.git`
 3. Set the compose file path to `docker-compose.yml`
 4. Add all environment variables from `.env.production` in Dokploy's environment settings
-5. Set the domain: `stoka.yourdomain.com`
+5. Set the domain: `gritdemo.yourdomain.com`
 6. Enable auto-SSL (Let's Encrypt via Traefik)
 7. Deploy
 
 ### Option B: Deploy via Docker Compose directly on VPS
 
 ```bash
 # Clone the repo
-git clone https://github.com/MUKE-coder/stoka.git
-cd stoka
+git clone https://github.com/MUKE-coder/grit.git
+cd grit/demo
 
 # Copy and edit production env
 cp .env.production .env.production.local
@@ -116,7 +116,7 @@ cp .env.production.local .env.production
 docker compose up -d --build
 
 # Check logs
-docker compose logs -f stoka
+docker compose logs -f gritdemo
 ```
 
 ---
@@ -127,7 +127,7 @@ After the first deploy, run migrations to create database tables:
 
 ```bash
 # Via docker exec
-docker compose exec stoka ./stoka migrate
+docker compose exec gritdemo ./gritdemo migrate
 
 # Or if you have the binary locally:
 # DATABASE_URL=postgres://... go run ./cmd/migrate
@@ -138,29 +138,29 @@ If using Dokploy, you can run this as a one-time command in the container termin
 **Alternative:** The app auto-migrates on startup if tables don't exist (via GORM AutoMigrate in the seed command). To seed demo data:
 
 ```bash
-docker compose exec stoka ./stoka seed
+docker compose exec gritdemo ./gritdemo seed
 ```
 
 ---
 
 ## Step 6: Verify
 
-1. Visit `https://stoka.yourdomain.com` — should show the login page
+1. Visit `https://gritdemo.yourdomain.com` — should show the login page
 2. Register a new account or use seeded credentials:
    - Admin: `admin@nakawafashion.com` / `password123`
-3. Check the health endpoint: `https://stoka.yourdomain.com/api/health`
+3. Check the health endpoint: `https://gritdemo.yourdomain.com/api/health`
 
 ---
 
 ## Step 7: Domain & SSL (Dokploy)
 
 In Dokploy:
 1. Go to your application → **Domains**
-2. Add domain: `stoka.yourdomain.com`
+2. Add domain: `gritdemo.yourdomain.com`
 3. Port: `8080`
 4. Enable HTTPS (Dokploy handles Let's Encrypt automatically via Traefik)
 
-Make sure your DNS has an **A record** pointing `stoka.yourdomain.com` to your VPS IP.
+Make sure your DNS has an **A record** pointing `gritdemo.yourdomain.com` to your VPS IP.
 
 ---
 
@@ -171,7 +171,7 @@ Push to `main` → trigger redeploy in Dokploy (or enable auto-deploy)
 
 ### Manual
 ```bash
-cd stoka
+cd grit/demo
 git pull
 docker compose up -d --build
 ```
@@ -185,7 +185,7 @@ docker compose up -d --build
 docker compose logs -f
 
 # Just the app
-docker compose logs -f stoka
+docker compose logs -f gritdemo
 
 # Database
 docker compose logs -f postgres
@@ -201,17 +201,17 @@ docker compose ps
 ### Database
 ```bash
 # Dump
-docker compose exec postgres pg_dump -U stoka stoka > backup_$(date +%Y%m%d).sql
+docker compose exec postgres pg_dump -U gritdemo gritdemo > backup_$(date +%Y%m%d).sql
 
 # Restore
-cat backup.sql | docker compose exec -T postgres psql -U stoka stoka
+cat backup.sql | docker compose exec -T postgres psql -U gritdemo gritdemo
 ```
 
 ### Volumes
 ```bash
 # Find volume paths
-docker volume inspect stoka_postgres_data
-docker volume inspect stoka_redis_data
+docker volume inspect gritdemo_postgres_data
+docker volume inspect gritdemo_redis_data
 ```
 
 ---
@@ -225,7 +225,7 @@ docker volume inspect stoka_redis_data
 | CORS errors | Add your domain to `CORS_ORIGINS` |
 | Images not loading | Check R2 credentials and bucket name |
 | Emails not sending | Verify `RESEND_API_KEY` and `MAIL_FROM` domain is verified in Resend |
-| Container keeps restarting | Check `docker compose logs stoka` for the error |
+| Container keeps restarting | Check `docker compose logs gritdemo` for the error |
 
 ---
 

demo/Dockerfile

@@ -1,33 +1,56 @@
-# Stage 1: Build frontend
+# syntax=docker/dockerfile:1.7
+#
+# Grit Motors — demo deployment Dockerfile.
+#
+# Three fixes vs the original kayula version (all of which broke on
+# Dokploy):
+#   1. Pin pnpm to v9.15.0 — pnpm@latest now resolves to v11+ which
+#      requires Node v22 (uses node:sqlite). Pinned matches the
+#      pnpm-lock.yaml v9.0 schema we ship.
+#   2. Final binary name renamed stoka → gritdemo to match the module.
+#   3. /app chowned to the non-root user before USER so Sentinel/Pulse
+#      can create their SQLite stores ("out of memory (14)" is actually
+#      SQLITE_CANTOPEN for permission-denied; not obvious from the log).
+
+# ── Stage 1: build the frontend ──────────────────────────────────────
 FROM node:20-alpine AS frontend
 WORKDIR /app/frontend
-RUN corepack enable && corepack prepare pnpm@latest --activate
+
+# Pinned pnpm version — pnpm@latest pulls v11+ which needs Node 22.
+RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+
 COPY frontend/package.json frontend/pnpm-lock.yaml ./
 RUN pnpm install --frozen-lockfile
 COPY frontend/ ./
 
-# Vite needs env vars at build time — pass via build args
+# Vite needs env vars at build time — pass via build args.
 ARG VITE_INTERNAL_API_KEY
-ARG VITE_APP_NAME=Kayula Motors
+ARG VITE_APP_NAME="Grit Motors"
 ENV VITE_INTERNAL_API_KEY=$VITE_INTERNAL_API_KEY
 ENV VITE_APP_NAME=$VITE_APP_NAME
 
 RUN pnpm build
 
-# Stage 2: Build Go binary
+# ── Stage 2: build the Go binary ─────────────────────────────────────
 FROM golang:1.24-alpine AS backend
 RUN apk add --no-cache git
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 COPY --from=frontend /app/frontend/dist ./frontend/dist
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o stoka .
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o gritdemo .
 
-# Stage 3: Final minimal image
+# ── Stage 3: minimal runtime image ───────────────────────────────────
 FROM alpine:3.20
-RUN apk --no-cache add ca-certificates tzdata
+RUN apk --no-cache add ca-certificates tzdata && \
+    addgroup -S grit && adduser -S -G grit grit
 WORKDIR /app
-COPY --from=backend /app/stoka .
+COPY --from=backend /app/gritdemo .
+# Sentinel + Pulse write SQLite stores into the working dir under their
+# own process user. Chown /app to grit BEFORE switching user so the
+# stores can be created at runtime.
+RUN chown -R grit:grit /app
+USER grit
 EXPOSE 8080
-CMD ["./stoka"]
+CMD ["./gritdemo"]

demo/Makefile

@@ -1,4 +1,4 @@
-# stoka — Single App Makefile
+# gritdemo — Single App Makefile
 
 .PHONY: dev build clean
 
@@ -13,8 +13,8 @@ build:
 	@echo "Building frontend..."
 	@cd frontend && pnpm install && pnpm build
 	@echo "Building Go binary..."
-	@go build -o bin/stoka .
-	@echo "Done! Binary at bin/stoka"
+	@go build -o bin/gritdemo .
+	@echo "Done! Binary at bin/gritdemo"
 
 # Clean build artifacts
 clean:

demo/docker-compose.yml

@@ -3,13 +3,13 @@ services:
     image: postgres:16-alpine
     restart: unless-stopped
     environment:
-      POSTGRES_USER: ${POSTGRES_USER:-kayula}
+      POSTGRES_USER: ${POSTGRES_USER:-gritdemo}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: ${POSTGRES_DB:-kayula}
+      POSTGRES_DB: ${POSTGRES_DB:-gritdemo}
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-kayula}"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-gritdemo}"]
       interval: 5s
       timeout: 5s
       retries: 5
@@ -26,7 +26,7 @@ services:
       timeout: 5s
       retries: 5
 
-  stoka:
+  gritdemo:
     build:
       context: .
       dockerfile: Dockerfile