Add LibreChat sandbox maintenance documentation

maintenance/librechat-sandbox.md

@@ -0,0 +1,32 @@
+# LibreChat sandbox maintenance
+
+**Current image**
+- Docker image: `cloudron/ai.librechat.cloudronapp:202610150224320000`
+- Deployed as app **0752e430‑aa36‑436e‑8668‑ef18da474f47** (LibreChat sandbox at `https://librechat-test.inference.coop`).
+
+**Automatic updates**
+- The "Automatic updates" toggle in the Cloudron UI has been turned **off** (as of 2026‑10‑18). This prevents the sandbox from pulling newer Docker images automatically.
+
+**Version‑pinning workflow**
+1. **Create a version tag** when a new LibreChat release is approved (e.g.
+   `cloudron/ai.librechat.cloudronapp:202610250100000000`).
+2. **Push the tagged image** to the co‑op registry (e.g. `registry.inference.coop/librechat:sandbox‑2026‑10‑25`).
+   ```bash
+   docker pull cloudron/ai.librechat.cloudronapp:<new‑tag>
+   docker tag cloudron/ai.librechat.cloudronapp:<new‑tag> registry.inference.coop/librechat:sandbox‑<date>
+   docker login registry.inference.coop   # use registry‑bot credentials
+   docker push registry.inference.coop/librechat:sandbox‑<date>
+   ```
+3. **Redeploy** the sandbox with the pinned tag:
+   ```bash
+   cloudron update --app 0752e430-aa36-436e-8668-ef18da474f47 \
+       --image registry.inference.coop/librechat:sandbox‑<date>
+   ```
+4. **Verify** the app is running (`cloudron status --app <id>`) and that the image field reflects the new tag.
+5. **Record** the change in this document (date, tag, reason) and optionally open a GitHub/Gitea issue linking to the upstream LibreChat release.
+
+**Rollback**
+- To roll back, repeat step 3 with the previous image tag.
+
+**Future maintainers**
+- All steps are captured in this doc and in the corresponding issue in `co‑op/support` (Issue #24). The `co‑op/docs` repository should contain this file; keep it up‑to‑date whenever the sandbox image changes or the automatic‑update flag is toggled.