docs: approve spec 001; self-hosted Bun server, defer password gate

The user signed off the spec. The server runs self-hosted under Bun;
the password gate and the Cloudflare Workers entry stay designed but
deferred until abuse or traffic calls for them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/DECISIONS.md

@@ -16,6 +16,19 @@ the repo every session — measurably slower and more tokens).
 **Consequences:** Rule changes happen in one file; pointer files must stay thin. Plans are working
 artefacts: kept after merge they go stale and contradict the code, so the spec is the record.
 
+## 2026-10-14 — Spec signed off; self-hosted only; password gate deferred
+**Status:** accepted (narrows the entry below)
+**Context:** The user signed off spec 001 and said the app will run self-hosted, and that
+password-gating should wait: "if it gets abused or we see too big amounts of traffic, we will deal
+with it then."
+**Decision:** First version runs `server/app.ts` under `Bun.serve` on our own machine behind our
+reverse proxy. No gate, no Cloudflare entry; both stay designed in the spec (§4.10, §4.11) and are
+listed under Someday in `docs/TODO.md`. The handler stays web-standard so either can be added later.
+**Alternatives:** Build the gate now (cost without a demonstrated need).
+**Consequences:** The site is open: the host allowlist, the 20 MB cap and the per-IP rate limit are
+the only protections. The rate limit needs the real client IP from our reverse proxy
+(`MBSEED_TRUST_PROXY`).
+
 ## 2026-10-14 — Also support catbox/litterbox; optional password gate; self-hostable server
 **Status:** accepted (extends the two entries below)
 **Context:** The user asked for catbox/litterbox support as well, and for a way to password-gate the