notes: private Obsidian vault tracker at /trackers/notes

Vault files stay the source of truth (bind-mounted read-write at /notes):
atomic writes chowned to the vault owner, hash-checked saves (409 on a
newer file), deletes to .trash. notes.* is a full-text/link index kept
current by a recursive watcher plus a 60s rescan; live updates over the
owner-only /ws/notes channel (paths and hashes only). Wikilinks, embeds,
backlinks, tags, callouts, image paste. Owner-only everywhere (404).

scripts/deploy-remote.sh

@@ -108,6 +108,30 @@ YAML
 else
   echo "No $pubg_tiles_host_dir/erangel on this host; the PUBG map will have no tiles" >&2
 fi
+# Notes tracker: the Obsidian vault (Syncthing folder "obsidian-vault") is bind-mounted READ-WRITE
+# at /notes. The files are the source of truth; the site edits them in place (atomic temp+rename,
+# chowned to the vault owner) and keeps notes.* as a search/link index. Owner-only in the app.
+notes_host_dir=${NOTES_HOST_DIR:-/home/stan/obsidian-vault}
+case "$notes_host_dir" in /*) ;; *) echo 'NOTES_HOST_DIR must be absolute' >&2; exit 2 ;; esac
+if sudo docker run --rm --entrypoint sh \
+  --mount "type=bind,source=$notes_host_dir,target=/notes,readonly" "$image" \
+  -c 'test -d /notes/.obsidian' 2>/dev/null; then
+  notes_override="$HOME/compose.notes.yml"
+  rm -f "$notes_override"
+  cat >"$notes_override" <<YAML
+services:
+  app:
+    environment:
+      NOTES_ROOT: /notes
+    volumes:
+      - type: bind
+        source: $notes_host_dir
+        target: /notes
+YAML
+  compose_files+=(-f "$notes_override")
+else
+  echo "No Obsidian vault at $notes_host_dir on this host; the notes tracker will be empty" >&2
+fi
 previous_tag=$(sed -n 's/^IMAGE_TAG=//p' "$directory/.env" | head -n 1)
 switched=0
 rollback() {