Sustainable LibreChat setup: official manifest, config layer, brand overlay

- CloudronManifest.json: byte-identical copy of the OFFICIAL appstore manifest
  (the hand-edited one stripped addons and crash-looped the app on 2026-10-18)
- Dockerfile: pinned base (202610150224320000), brand assets only + title sed
- librechat.yaml: schema 1.3.17; chat models only in picker (qwen-image moved
  to the agent image tool); speech via gateway with capped key refs; SearXNG
  web search; inference-docs MCP server; forward-compatible interface.theme
- mcp/server.py: docs MCP server (stdio, stdlib-only, tool search_docs)
- assets/: co-op logo + favicons/PWA icons

Dockerfile

@@ -1,9 +1,34 @@
+# Inference Co-op LibreChat — brand overlay on the official Cloudron package
+#
+# Build:  cloudron builder build --repository registry.inference.coop/co-op/librechat-custom --tag <yyyymmdd>-<gitsha>
+# Deploy: cloudron update --app <app-id> --image registry.inference.coop/co-op/librechat-custom:<tag>
+#         (run from THIS directory — the CLI reads CloudronManifest.json here)
+#
+# Rules that keep this image safe:
+#   1. The base tag is PINNED to the exact appstore image the app runs
+#      (manifest.dockerImage). Never a floating tag: a rebuild must never
+#      silently pull a newer LibreChat than the one we validated.
+#   2. NEVER edit CloudronManifest.json — the copy in this repo must stay
+#      byte-identical to the OFFICIAL appstore manifest. `cloudron update`
+#      reads it from the deploy directory and applies it to the app; a
+#      hand-edited manifest that omits addons (postgresql, mongodb, oidc,
+#      sendmail, localstorage) strips them from the app and crash-loops it
+#      (mkdir: Read-only file system). That is what broke the sandbox on
+#      2026-10-18 — the manifest, not the overlay, was the bug.
+#   3. This image changes ONLY static brand assets. All behavior lives on the
+#      persistent volume (/app/data/librechat.yaml, /app/data/env,
+#      /app/data/mcp/) and survives image updates unchanged.
 FROM cloudron/ai.librechat.cloudronapp:202610150224320000
 
-# Overwrite LibreChat config with our custom version (includes icons, models, themes, API keys settings)
-COPY librechat.yaml /app/code/librechat/librechat.yaml
+# Login-page + header logo (the client bundle references assets/logo.svg)
+COPY assets/logo.svg /app/code/librechat/client/dist/assets/logo.svg
+# Browser favicons + PWA icons (referenced by dist/index.html + manifest.webmanifest)
+COPY assets/favicon-32x32.png /app/code/librechat/client/dist/assets/favicon-32x32.png
+COPY assets/favicon-16x16.png /app/code/librechat/client/dist/assets/favicon-16x16.png
+COPY assets/apple-touch-icon-180x180.png /app/code/librechat/client/dist/assets/apple-touch-icon-180x180.png
+COPY assets/icon-192x192.png /app/code/librechat/client/dist/assets/icon-192x192.png
+COPY assets/maskable-icon.png /app/code/librechat/client/dist/assets/maskable-icon.png
 
-COPY CloudronManifest.json /app/CloudronManifest.json
-RUN mkdir -p /app/data/public/assets
-COPY logo.svg /app/code/librechat/client/dist/assets/logo.svg
-COPY logo.png /app/code/librechat/client/dist/assets/logo-coop.png
+# Browser-tab title (index.html is baked at build; sed no-ops harmlessly if
+# the upstream markup ever changes)
+RUN sed -i 's|<title>LibreChat</title>|<title>Inference Co-op</title>|' /app/code/librechat/client/dist/index.html