Close out issue 001: document CSRF/reverse-proxy requirement

The app-side fix (CSRF_TRUSTED_ORIGINS, SECURE_PROXY_SSL_HEADER in
settings.py) was already committed as d458cd3 after the first Cloud-VM-1
deployment hit "CSRF verification failed" on login behind Apache. This
finishes the rest of that issue's checklist: documents
DJANGO_CSRF_TRUSTED_ORIGINS in deploy/env.example, adds the required
X-Forwarded-Proto header to the Apache/Caddy examples in
cloud_agent_deploy.md (plus a checklist item that verifies via an actual
login, not just an unauthenticated capabilities curl), and adds the same
proxy-agnostic guidance to docs/deployment.md.

Also introduces issues/, a tracked one-file-per-issue log for the project
going forward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/deployment.md

@@ -159,9 +159,23 @@ If putting Daybook behind Nginx, Caddy, Traefik, or a cloud load balancer:
 - Proxy to `http://<vm-ip>:8000`.
 - Add the public hostname to `DJANGO_ALLOWED_HOSTS`.
 - Terminate TLS at the proxy; keep `DJANGO_DEBUG=0`.
+- Set `DJANGO_CSRF_TRUSTED_ORIGINS` to the public HTTPS origin, **and**
+  configure the proxy to forward `X-Forwarded-Proto: https`. Without both,
+  login and any other POST fails with "CSRF verification failed" — Django
+  has no way to know the original request was HTTPS once the proxy
+  terminates TLS and forwards plain HTTP to the container.
 
 ```text
 DJANGO_ALLOWED_HOSTS=daybook.example.com,localhost,127.0.0.1
+DJANGO_CSRF_TRUSTED_ORIGINS=https://daybook.example.com
+```
+
+Forwarding the proto header, by proxy:
+
+```text
+Nginx:   proxy_set_header X-Forwarded-Proto $scheme;
+Apache:  RequestHeader set X-Forwarded-Proto "https"   (requires a2enmod headers)
+Caddy:   header_up X-Forwarded-Proto https
 ```
 
 ## Deployment Checklist
@@ -169,6 +183,8 @@ DJANGO_ALLOWED_HOSTS=daybook.example.com,localhost,127.0.0.1
 - `deploy/.env` exists with a real (non-placeholder) `DJANGO_SECRET_KEY`.
 - `DJANGO_DEBUG=0`.
 - `DJANGO_ALLOWED_HOSTS` includes the hostname/IP being used.
+- If behind a reverse proxy: `DJANGO_CSRF_TRUSTED_ORIGINS` is set and the
+  proxy forwards `X-Forwarded-Proto: https` (login will 403 otherwise).
 - `deploy/data/` exists and persists across `git pull` + rebuild.
 - `docker compose -f deploy/docker-compose.yml ps` shows `daybook` healthy.
 - `curl -fsS http://127.0.0.1:8000/api/capabilities` returns 403 without auth,