Add upgrade runbook + bake memory limit and LITELLM_MIGRATION_DIR into packaging

The 2026-10-02 outage had three causes the runbook now prevents:
- floating tag drift (README now mandates exact-tag pinning)
- 256MB default cgroup cap OOM-killing the prisma migration engine
  (manifest now sets memoryLimit: 2147483648)
- no _prisma_migrations ledger -> P3005 crash-loop on boot
  (start.sh now exports LITELLM_MIGRATION_DIR=/app/data/migrations)

README 'Updating LiteLLM' section rewritten from the old (wrong)
floating-tag procedure into a runbook with rules + verify checklist.

start.sh

@@ -61,6 +61,13 @@ export STORE_MODEL_IN_DB="True"
 # (for single-instance deployment this is fine)
 export DISABLE_SCHEMA_UPDATE="false"
 
+# The DB was created by `prisma db push` (no _prisma_migrations ledger), so on
+# first boot after a version change LiteLLM hits P3005 ("schema is not empty")
+# and must baseline the existing schema. That baseline write needs a WRITABLE
+# directory — the package dir is read-only under Cloudron's rootfs, so point it
+# at the persistent volume. Without this the boot migration crash-loops.
+export LITELLM_MIGRATION_DIR="/app/data/migrations"
+
 # UI configuration — use Cloudron's domain
 export UI_USERNAME="admin"
 export UI_PASSWORD="${LITELLM_MASTER_KEY}"