docs: state the wire-verified truth about /ui, docs surfaces and CORS (audit M4+L5); manifest contactEmail (L6)

Wire-verified on the pinned v1.103.2 (2026-11-05): NO_DOCS/NO_REDOC/
NO_OPENAPI do disable /docs, /redoc and /openapi.json (live 404s), but
DISABLE_ADMIN_UI only disables the UI's SSO login-redirect routes in this
version — the static /ui/ bundle is mounted unconditionally and still
serves (login stays master-key-gated). README 'Admin access' and the
start.sh comment now say exactly that, with the build-patch path if the
bundle itself should ever be removed. There is no env/flag for it on
this version, so the README is corrected instead (M4).

CORS reality recorded: LITELLM_CORS_ORIGINS is set at the app level to *
by co-op decision (co-op/support#38); start.sh's chat-origin fallback
applies only if the app env omits it. PublicAI (removed 2026-10-16,
replaced by Regolo) dropped from the provider lists; chat is LibreChat,
not Open WebUI. The embedded first-boot fallback config cannot be served
(overwritten by the same boot's image sync) — noted inline.

Manifest contactEmail: botbot@hermes -> info@inference.coop (L6).

start.sh

@@ -77,10 +77,13 @@ export LITELLM_MIGRATION_DIR="/app/data/migrations"
 export UI_USERNAME="admin"
 export UI_PASSWORD="${LITELLM_MASTER_KEY}"
 
-# DISABLE the admin UI and API docs. The gateway must stay publicly reachable
-# for the /v1 API (member keys), but we don't want to advertise a login-gated
-# admin console (/ui) or LiteLLM's Swagger/ReDoc/openapi surfaces. Admin
-# visibility comes from the admin dashboard / the API directly.
+# Nothing disables the static /ui admin bundle on the pinned v1.103.2 (there
+# is no flag for it): DISABLE_ADMIN_UI="True" only turns off the UI's SSO
+# login-redirect routes upstream — GET /ui/ still serves the static login
+# page. Logging into it still requires the master key, and the docs surfaces
+# below ARE fully disabled (NO_DOCS/NO_REDOC/NO_OPENAPI → 404s). See README
+# "Admin access" for the wire-verified state and the patch needed to remove
+# the bundle itself. Kept set because the SSO-redirect disable is still real.
 export DISABLE_ADMIN_UI="True"
 export NO_DOCS="True"
 export NO_REDOC="True"
@@ -166,6 +169,14 @@ if [ -f /app/code/config.yaml ] && ! cmp -s /app/code/config.yaml "$CONFIG_FILE"
     echo "Updating /app/data/config.yaml from the image (repo is the source of truth)"
     cp /app/code/config.yaml "$CONFIG_FILE"
 fi
+# NOTE on the fallback config written above: it can never be SERVED. The very
+# same boot's sync above overwrites it with the image's (repo) config whenever
+# they differ — including the boot right after the fallback ran. It is dead
+# by construction; it exists only so the container is never left with an
+# empty config file if the volume copy vanishes. Historically this block
+# carried stale api.tinfoil.sh models that could have resurrected — that
+# cannot happen through this path, and the shipped /app/code/config.yaml is
+# the live catalog.
 
 # --- Start LiteLLM ---
 echo "Starting LiteLLM on port 4000..."