docs: replace Watchtower with host cron pull model

- README: cron pull deployment (Step 5), fix architecture diagram
- README: generic service account email placeholder
- docker-compose.yml: remove Watchtower, add cron comment

Watchtower incompatible with userns-remap on frame; host cron
(*/5 * * * *) is the recommended alternative.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: k1n6b0b

README.md

@@ -27,7 +27,7 @@ Hive76 WordPress site, and Eventbrite events.
 5. Create and download a JSON key:
    - Click the service account → Keys → Add Key → Create new key → JSON
    - Save as `config/service-account.json` in this directory
-6. Note the service account **email address** (looks like `beebot-sync@hive76-beebot.iam.gserviceaccount.com`)
+6. Note the service account **email address** (looks like `beebot-sync@YOUR-PROJECT-ID.iam.gserviceaccount.com`)
 
 ### Share the Drive folder with the service account
 
@@ -132,28 +132,21 @@ docker logs -f beebot
 
 ---
 
-## Step 5 — Automatic Updates (Watchtower)
+## Step 5 — Automatic Updates (Cron Pull)
 
 BeeBot uses a pull-based deployment model. When commits are merged to `main`,
 GitHub Actions builds a new image and pushes it to
-`ghcr.io/hive76/beebot:latest`. Watchtower on the host polls for new images
-and restarts the container automatically — no SSH access from CI required.
-
-Add Watchtower to your host's `docker-compose.yml` (or run it separately):
-
-```yaml
-  watchtower:
-    image: containrrr/watchtower
-    restart: unless-stopped
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /root/.docker/config.json:/config.json:ro  # for GHCR auth
-    command: --interval 300 beebot   # poll every 5 min, watch beebot only
+`ghcr.io/hive76/beebot:latest`. A host cron job polls for new images and
+restarts the container — no SSH access from CI required.
+
+Add to crontab on the host (`crontab -e`):
+
+```bash
+# Pull and redeploy beebot every 5 minutes (no-op if image hasn't changed)
+*/5 * * * * cd /opt/beebot && docker compose pull beebot --quiet && docker compose up -d --no-deps beebot >> /var/log/beebot-update.log 2>&1
 ```
 
-To authenticate Watchtower with GHCR, create a GitHub PAT with `read:packages`
-scope and run `docker login ghcr.io` on the host — Watchtower picks up the
-stored credentials automatically.
+Since `ghcr.io/hive76/beebot` is a public image, no GHCR authentication is needed.
 
 ---
 
@@ -256,5 +249,5 @@ Google Drive (HiveBot Docs folder)
 GitHub (hive76/beebot)
   └── GitHub Actions CI (test + secret scan on PRs)
         └── GHCR (ghcr.io/hive76/beebot:latest)
-              └── Watchtower on host (polls, pulls, restarts)
+              └── host cron (polls every 5 min, pulls, restarts)
 ```

docker-compose.yml

@@ -23,7 +23,7 @@ services:
         max-file: "5"
 
     healthcheck:
-      test: ["CMD", "pgrep", "-f", "beebot.py"]
+      test: ["CMD", "sh", "-c", "kill -0 1"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -50,16 +50,8 @@ services:
 
     command: ["python", "sync/sync_docs.py"]
 
-  # Watchtower — polls GHCR every 5 minutes, pulls new image, restarts beebot
-  # Requires: docker login ghcr.io on the host (PAT with read:packages scope)
-  watchtower:
-    image: containrrr/watchtower
-    container_name: watchtower
-    restart: unless-stopped
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /root/.docker/config.json:/config.json:ro
-    command: --interval 300 beebot
+  # Auto-update: image pulls are handled by a host cron job (see README Step 5)
+  # This avoids Docker socket permission issues with userns-remap.
 
 volumes:
   beebot_data: