gateway: deploy config.yaml changes (the volume was shadowing the image)

Deploying the audio-pricing change proved the gap: the image built and the app
restarted, but /model/info still served the old prices — /app/data is a
persistent volume, so the Dockerfile's COPY config.yaml /app/data/config.yaml is
shadowed by the volume's file from the first install, and start.sh only wrote a
default when the file was missing. Config changes in this repo therefore never
reached a running gateway; the audit's byte-identical md5 check was a manual
sync.

Fix: ship a second copy at /app/code/config.yaml and have start.sh sync it over
the volume at boot whenever they differ. The repo stays the source of truth, the
legacy first-boot default remains, and the README documents the flow.

README.md

@@ -85,6 +85,14 @@ The following are auto-generated and should **not** be set manually:
 - `DATABASE_URL` — from Cloudron's PostgreSQL addon
 - `REDIS_HOST`, `REDIS_PORT`, `REDIS_PASSWORD` — from Cloudron's Redis addon
 
+### Config deployment
+
+`config.yaml` ships **with the image** and `start.sh` syncs it over the persistent
+`/app/data/config.yaml` at boot whenever they differ. The volume copy would
+otherwise shadow the image's file forever — which is exactly how a config change
+can be merged, built and "deployed" while the gateway keeps serving the old
+configuration. Change the repo and redeploy; never edit the volume copy directly.
+
 ### Admin access
 
 The LiteLLM admin UI and API docs are **disabled** on the public gateway (hardened by default; see `start.sh`). Administrative operations run through the [member portal](https://git.inference.coop/code/member-portal), which holds the master key server-side. If direct LiteLLM admin access is ever needed, re-enable the UI in `start.sh`, redeploy, and use the master key from `/app/data/.master_key` — then disable it again.