Money: private Documents page with admin-only file endpoint

Lists contracts/pension docs with written summaries, an inline viewer and
download at /trackers/money/documents. Files and summaries live on the host
(MONEY_DOCUMENTS_ROOT, bind-mounted read-only by deploy-remote.sh), never in
git or static/; the file endpoint is admin-only (401/403) and private, no-store.

scripts/deploy-remote.sh

@@ -58,6 +58,31 @@ YAML
 else
   echo "No $books_host_dir/library on this host; book files will not be readable" >&2
 fi
+# Private money documents (contracts, pension rules) + their summaries also live on the host,
+# outside the repo, bind-mounted read-only at /money-documents. The app streams them only to an
+# admin via /trackers/money/documents/<id>/file. Layout: documents.json + files/<file>.
+money_documents_host_dir=${MONEY_DOCUMENTS_HOST_DIR:-/home/stan/money-documents}
+case "$money_documents_host_dir" in /*) ;; *) echo 'MONEY_DOCUMENTS_HOST_DIR must be absolute' >&2; exit 2 ;; esac
+if sudo docker run --rm --entrypoint sh \
+  --mount "type=bind,source=$money_documents_host_dir,target=/money-documents,readonly" "$image" \
+  -c 'test -f /money-documents/documents.json' 2>/dev/null; then
+  money_documents_override="$HOME/compose.money-documents.yml"
+  rm -f "$money_documents_override"
+  cat >"$money_documents_override" <<YAML
+services:
+  app:
+    environment:
+      MONEY_DOCUMENTS_ROOT: /money-documents
+    volumes:
+      - type: bind
+        source: $money_documents_host_dir
+        target: /money-documents
+        read_only: true
+YAML
+  compose_files+=(-f "$money_documents_override")
+else
+  echo "No $money_documents_host_dir/documents.json on this host; money documents will not be readable" >&2
+fi
 previous_tag=$(sed -n 's/^IMAGE_TAG=//p' "$directory/.env" | head -n 1)
 switched=0
 rollback() {