fix(phoenixd): dot-free datadir + data_uid; docs: iframe rules

phoenixd: the orchestrator treats bind paths containing a dot as file
mounts and never creates their source dir, so the image's default
/phoenix/.phoenix target crash-looped the unit (statfs: no such file).
Datadir moved to /data via PHOENIX_DATADIR; data_uid 1000:1000 matches the
image's phoenix user — without it phoenixd dies on phoenix.conf
'Permission denied'. Both verified end-to-end on archi-dev-box: orch
install OK, seed.dat + db on the host, authenticated /getinfo answers.

alby-hub: launch flips to embedded — pairs with the gate change that
neutralizes upstream frame blocking.

Dev guide: iframe embedding rules (who blocks framing and why the gate
may strip it; when open_in_new_tab is legitimate; test in the embedded
session, never a tab).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/phoenixd/manifest.yml

@@ -10,6 +10,10 @@ app:
     # --http-bind-ip 0.0.0.0, as user "phoenix"; no custom args needed.
     image: source.archipelago-foundation.org/lfg2025/phoenixd:0.9.0
     pull_policy: if-not-present
+    # The image runs as user phoenix (1000:1000); the datadir bind source
+    # must be chowned to that identity or phoenixd dies on
+    # "Failed to open /data/phoenix.conf with Permission denied".
+    data_uid: "1000:1000"
 
   dependencies:
     - storage: 500Mi
@@ -41,11 +45,18 @@ app:
     # The wallet seed (seed.dat) and phoenix.conf live here. This directory
     # must survive reinstall/migration like any other app data dir —
     # losing it means losing funds.
+    # Target is /data (via PHOENIX_DATADIR below), NOT the image's default
+    # /phoenix/.phoenix: the orchestrator treats any bind path containing a
+    # dot as a file mount and skips creating its source directory, so a
+    # hidden-dir target never gets its host dir and the unit crash-loops.
     - type: bind
       source: /var/lib/archipelago/phoenixd
-      target: /phoenix/.phoenix
+      target: /data
       options: [rw]
 
+  environment:
+    - PHOENIX_DATADIR=/data
+
   health_check:
     type: tcp
     endpoint: localhost:9740