docs: add standalone deployment options and proxy registration guide

Add standalone Docker and bare-metal deployment sections to DEPLOYMENT.md
for users with existing PostgreSQL and S3 infrastructure. Create new
PROXY-REGISTRATION.md covering end-to-end node registration, JWT auth,
bundle deployment, bulk registration, and troubleshooting. Update
GETTING-STARTED.md with cross-references to the new guides.

Author: raffaelschneider

docs/DEPLOYMENT.md

@@ -1,6 +1,6 @@
 # Deployment
 
-## Docker
+## Docker Compose
 
 ### docker-compose.yml
 
@@ -68,6 +68,188 @@ docker compose up
   └─ Phoenix server starts on :4000
 ```
 
+## Standalone Docker
+
+For users who already have PostgreSQL and S3-compatible storage and just need to run the control plane container.
+
+### Prerequisites
+
+- PostgreSQL 15+ (managed or self-hosted)
+- S3-compatible storage (AWS S3, MinIO, DigitalOcean Spaces, etc.)
+- Docker
+
+### Pull or Build the Image
+
+```bash
+# Build from source
+docker build -t zentinel-cp .
+```
+
+### Run Migrations and Seed
+
+Before starting the application for the first time, run database migrations and seed the default admin user:
+
+```bash
+docker run --rm \
+  -e DATABASE_URL="ecto://user:pass@db-host:5432/zentinel_cp" \
+  -e SECRET_KEY_BASE="$(openssl rand -base64 48)" \
+  zentinel-cp bin/zentinel_cp eval "ZentinelCp.Release.migrate()"
+
+docker run --rm \
+  -e DATABASE_URL="ecto://user:pass@db-host:5432/zentinel_cp" \
+  -e SECRET_KEY_BASE="$(openssl rand -base64 48)" \
+  zentinel-cp bin/zentinel_cp eval "ZentinelCp.Release.seed()"
+```
+
+### Start the Control Plane
+
+```bash
+docker run -d \
+  --name zentinel-cp \
+  -p 4000:4000 \
+  -e DATABASE_URL="ecto://user:pass@db-host:5432/zentinel_cp" \
+  -e SECRET_KEY_BASE="$(mix phx.gen.secret)" \
+  -e PHX_HOST="cp.example.com" \
+  -e S3_ENDPOINT="https://s3.amazonaws.com" \
+  -e S3_BUCKET="zentinel-bundles" \
+  -e S3_ACCESS_KEY_ID="AKIA..." \
+  -e S3_SECRET_ACCESS_KEY="..." \
+  -e S3_REGION="us-east-1" \
+  -e FORCE_SSL="true" \
+  zentinel-cp
+```
+
+The entrypoint automatically runs migrations and seeds on startup, so the separate migration step is only needed if you want to run migrations independently.
+
+### Healthcheck
+
+The container includes a built-in healthcheck:
+
+```bash
+curl -f http://localhost:4000/health
+```
+
+### Rollback Migrations
+
+```bash
+docker run --rm \
+  -e DATABASE_URL="ecto://user:pass@db-host:5432/zentinel_cp" \
+  -e SECRET_KEY_BASE="any-value" \
+  zentinel-cp bin/zentinel_cp eval "ZentinelCp.Release.rollback(ZentinelCp.Repo, 20240101000000)"
+```
+
+Replace the version number with the migration timestamp you want to roll back to.
+
+## From Source (Bare Metal / VM)
+
+For users who want to build and run a native OTP release without Docker.
+
+### Prerequisites
+
+- Elixir 1.16+ and Erlang/OTP 26+
+- PostgreSQL 15+
+- S3-compatible storage
+- `zentinel` CLI binary (for bundle validation/compilation)
+- Node.js (for asset compilation)
+
+### Build the Release
+
+```bash
+git clone https://github.com/zentinelproxy/zentinel-control-plane.git
+cd zentinel-control-plane
+
+export MIX_ENV=prod
+
+mix deps.get --only prod
+mix compile
+mix assets.deploy
+mix release
+```
+
+The release is built to `_build/prod/rel/zentinel_cp/`.
+
+### Run Migrations and Seed
+
+```bash
+export DATABASE_URL="ecto://user:pass@localhost:5432/zentinel_cp"
+export SECRET_KEY_BASE="$(mix phx.gen.secret)"
+
+_build/prod/rel/zentinel_cp/bin/zentinel_cp eval "ZentinelCp.Release.migrate()"
+_build/prod/rel/zentinel_cp/bin/zentinel_cp eval "ZentinelCp.Release.seed()"
+```
+
+### Start the Server
+
+```bash
+export DATABASE_URL="ecto://user:pass@localhost:5432/zentinel_cp"
+export SECRET_KEY_BASE="your-secret-key-base"
+export PHX_HOST="cp.example.com"
+export S3_ENDPOINT="https://s3.amazonaws.com"
+export S3_BUCKET="zentinel-bundles"
+export S3_ACCESS_KEY_ID="AKIA..."
+export S3_SECRET_ACCESS_KEY="..."
+export ZENTINEL_BINARY="/usr/local/bin/zentinel"
+
+PHX_SERVER=true _build/prod/rel/zentinel_cp/bin/zentinel_cp start
+```
+
+### systemd Service
+
+Create `/etc/systemd/system/zentinel-cp.service`:
+
+```ini
+[Unit]
+Description=Zentinel Control Plane
+After=network.target postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=exec
+User=zentinel
+Group=zentinel
+WorkingDirectory=/opt/zentinel-cp
+ExecStart=/opt/zentinel-cp/bin/zentinel_cp start
+ExecStop=/opt/zentinel-cp/bin/zentinel_cp stop
+Restart=on-failure
+RestartSec=5
+
+Environment=PHX_SERVER=true
+Environment=PORT=4000
+Environment=PHX_HOST=cp.example.com
+Environment=FORCE_SSL=true
+Environment=POOL_SIZE=10
+Environment=ZENTINEL_BINARY=/usr/local/bin/zentinel
+
+EnvironmentFile=/etc/zentinel-cp/env
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Store secrets in `/etc/zentinel-cp/env` (mode `0600`):
+
+```bash
+DATABASE_URL=ecto://zentinel:password@localhost:5432/zentinel_cp
+SECRET_KEY_BASE=your-secret-key-base-here
+S3_ENDPOINT=https://s3.amazonaws.com
+S3_BUCKET=zentinel-bundles
+S3_ACCESS_KEY_ID=AKIA...
+S3_SECRET_ACCESS_KEY=...
+```
+
+Enable and start:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable zentinel-cp
+sudo systemctl start zentinel-cp
+sudo journalctl -u zentinel-cp -f
+```
+
+## Connecting Proxies
+
+After deployment, see [PROXY-REGISTRATION.md](PROXY-REGISTRATION.md) for a complete guide on registering zentinel proxy instances with the control plane.
+
 ## Rollout Strategies
 
 ### Rolling (Default)

docs/GETTING-STARTED.md

@@ -9,6 +9,8 @@
 - Docker — for MinIO (bundle storage)
 - `zentinel` CLI binary — for configuration validation and compilation
 
+**Standalone / production deployment:** If you have your own PostgreSQL and S3, see the [standalone Docker and bare-metal options in DEPLOYMENT.md](DEPLOYMENT.md#standalone-docker).
+
 ## Docker Compose
 
 Starts the control plane, PostgreSQL 17, and MinIO with one command:
@@ -148,7 +150,7 @@ Roles are per-organization. A user can have different roles in different orgs.
      -H "Content-Type: application/json" \
      -d '{"name": "proxy-1", "labels": {"env": "dev"}}'
    ```
-   Store the returned `node_key` — it is only shown once.
+   Store the returned `node_key` — it is only shown once. See [PROXY-REGISTRATION.md](PROXY-REGISTRATION.md) for the full guide on connecting proxies, configuring JWT auth, and deploying bundles.
 
 6. **Deploy with a Rollout** — Rollouts > New Rollout. Select bundle, choose strategy (rolling, canary, blue-green, all-at-once), configure health gates, start.
 
@@ -159,6 +161,7 @@ Roles are per-organization. A user can have different roles in different orgs.
 - [AUTHENTICATION.md](AUTHENTICATION.md) — API keys, node auth, SSO, MFA
 - [CONFIGURATION.md](CONFIGURATION.md) — Services, upstreams, TLS, environment variables
 - [DEPLOYMENT.md](DEPLOYMENT.md) — Production deployment and rollout strategies
+- [PROXY-REGISTRATION.md](PROXY-REGISTRATION.md) — Connecting proxy instances to the control plane
 - [SECURITY.md](SECURITY.md) — WAF, auth policies, bundle signing
 - [OBSERVABILITY.md](OBSERVABILITY.md) — Prometheus, SLOs, alerts, tracing
 - [DEVELOPMENT.md](DEVELOPMENT.md) — Building, testing, contributing