docs(readme): add server section with MinIO tunnel; refresh stale sections

New section 'Working with the deployed system (server)': public app and Casdoor panel URLs (aramesh / casdoor .bennu-api-bahrestan.ir) and step-by-step MinIO console access via an SSH tunnel (ssh -L 9001:127.0.0.1:9001 root@171.22.25.75 -> http://localhost:9001), including the aramesh-minio credentials, the procurement-files bucket, why the console is loopback-only (port 9000 is reserved for the deploy-webhook receiver), the secret-handling warning and the tunnel teardown.

Also refreshed sections that went stale this session: the login form description no longer mentions the removed optional organization field; the restore section now documents the committed admin-only seed dumps in backups/علی محقق/ (the old restore.ps1/sh scripts and demo dumps were deleted) with the current login and the still-available demo seeders.

README.md

@@ -81,7 +81,7 @@ v1.3/
 ## 🔐 Login
 
 The whole system is behind a login page (`/login`). Login is **in-page**:
-the form (username / password / optional organization) is sent to
+the form (username / password) is sent to
 `POST /api/v1/auth/login`; the backend exchanges it with Casdoor
 (password grant), verifies the returned JWT, and starts the session —
 no browser redirect to Casdoor.
@@ -113,6 +113,71 @@ Casdoor organization, application and users (idempotent). Full details —
 addresses, credentials, role model, failure scenarios and the checklist —
 are in [`docs/casdoor-auth.md`](docs/casdoor-auth.md).
 
+> The **currently committed seed** (`backups/علی محقق/`) instead ships a
+> single admin — `ali.mohaghegh` («علی محقق») — see
+> [Restoring the committed seed data](#restoring-the-committed-seed-data).
+
+---
+
+## 🌐 Working with the deployed system (server)
+
+The production deployment of this stack runs on the server and is reachable
+at these public addresses (HTTPS):
+
+| What | Address |
+|---|---|
+| **App (ERP)** | https://aramesh.bennu-api-bahrestan.ir/ |
+| **Casdoor admin panel** | https://casdoor.bennu-api-bahrestan.ir/ |
+
+Log in to the app with your Casdoor account (org `inventory`); the role is
+assigned inside the app (`users.role` — see «Login» above and
+[`docs/casdoor-auth.md`](docs/casdoor-auth.md)).
+
+### MinIO console on the server (SSH tunnel)
+
+The MinIO console is deliberately **loopback-only** on the server
+(`127.0.0.1:9001`) — verified unreachable from the internet — so the way in
+is an SSH tunnel from your machine:
+
+1. Open PowerShell and start the tunnel (**keep the window open** while you
+   use the panel):
+
+   ```powershell
+   ssh -L 9001:127.0.0.1:9001 root@171.22.25.75
+   ```
+
+   You will also land in a normal SSH session — that is fine; the tunnel
+   lives as long as the window stays open.
+
+2. In your browser, open: **http://localhost:9001**
+
+3. Log in with:
+
+   | Username | Password |
+   |---|---|
+   | `aramesh-minio` | `feb10fadb5441019dfc33bf12a9b0f74e7b6c478` |
+
+You will see the **`procurement-files`** bucket — the invoices/proformas the
+ERP stores, browsable and downloadable from there.
+
+⚠️ These credentials are **full admin access to the file storage**. Treat
+them as a production secret (this README is inside the repo, so anyone with
+repo access can read them — rotate them on the server if they ever leak).
+
+Close the PowerShell window (or `Ctrl+C`) when you are done to drop the
+tunnel.
+
+Notes from the server setup:
+
+- The panel is published only on the server's loopback, so the internet
+  cannot reach it at all — the tunnel is what carries it to your browser.
+- Host port `9000` stays reserved for the deploy-webhook receiver, which is
+  why the console uses `9001`.
+- If you ever need the raw S3 API from your machine, or a clickable URL for
+  the console (e.g. `storage.aramesh.bennu-api-bahrestan.ir` behind Traefik
+  with a password prompt on top), that can be arranged on request — the
+  tunnel remains the safer default.
+
 ---
 
 ## Prerequisites (target machine)
@@ -197,26 +262,35 @@ docker exec -it procurement-postgres psql -U postgres -d procurement
 
 ---
 
-## Restoring the demo data (for the team)
+## Restoring the committed seed data
 
-The databases are **not** in git — Docker volumes hold the data. To let
-everyone see the same system state, the repo ships exact database dumps in
-`backups/`. After a fresh boot:
+The databases are **not** in git — Docker volumes hold the data. The repo
+ships recovery dumps in `backups/علی محقق/`:
+
+| File | Contents |
+|---|---|
+| `casdoor.dump` | Casdoor schema + console admin (`admin` / `123`), org `inventory`, app `inventory-app`, the JWT signing cert, and the single org user `ali.mohaghegh` |
+| `procurement.dump` | Procurement schema + the single `users` row «علی محقق» with role `admin`; all other tables empty (categories/units re-seed at API startup) |
+
+⚠️ This **replaces all data** in the `procurement` and `casdoor` databases.
+On a running stack:
 
 ```powershell
-powershell -ExecutionPolicy Bypass -File .\backups\restore.ps1     # Windows
-bash backups/restore.sh                                            # Linux / Git Bash
+docker compose stop api casdoor
+docker cp "backups/علی محقق/procurement.dump" procurement-postgres:/tmp/
+docker cp "backups/علی محقق/casdoor.dump" procurement-postgres:/tmp/
+docker exec procurement-postgres pg_restore -U postgres -d procurement --clean --if-exists /tmp/procurement.dump
+docker exec procurement-postgres pg_restore -U postgres -d casdoor    --clean --if-exists /tmp/casdoor.dump
+docker compose start casdoor api
 ```
 
-This **replaces all data** in the `procurement` and `casdoor` databases with
-the committed state — a clean, realistic demo: 3 projects × 2 warehouses,
-4 suppliers, 12 materials across all 8 categories, and 4 quotes covering
-every lifecycle state (offered / in-transit / partially received /
-completed) with matching stock.
+Login afterwards: `ali.mohaghegh` / `hulkfuck002` (Casdoor rejects spaces
+in usernames, so «ali mohaghegh» is not a valid login name).
 
-Two alternative ways to get a clean state:
+Want demo data instead? Two seeders are still available (they create
+different users — see the Login table above):
 
-1. **App seeder** (realistic demo data, keeps the Casdoor org as-is):
+1. **App seeder** (realistic demo dataset; keeps the Casdoor org as-is):
    ```powershell
    docker exec procurement-api sh -c "cd /srv/backend && python -m tools.seed"
    ```