M3: Cloudflare Containers deploy docs #33

Context

PRD: docs/PRD.md §10, milestone M3. Scratch image already builds via make docker.

Goal

Short runbook to run aixgo-sync on Cloudflare Containers with R2 as source of truth (ephemeral container disk). Cloudflare is the host, not the product — document env and ports, not a rewrite.

Out of scope

• Automating production deploys from this issue alone (Actions may come later)
• Self-host NATS runbook (M4 / later)
• Changing the public HTTPS+S3 contract

Deliverable

docs/deploy-containers.md (or README section) covering:

• Build/push image expectations
• Required env (SYNC_S3_*, SYNC_API_KEYS, PORT/SYNC_PORT)
• Health check /healthz
• R2 bucket + API token notes (no secrets in git)
• Reminder: lose a container → documents remain in R2

Acceptance criteria

• Doc exists and links from README
• Env table matches current code
• make check unaffected

Dependencies

None blocked on code; prefer after auth+R2 are the default production path.

How to hand to Aixgo Code

Apply ax:go anytime; good parallel docs slice.