docs: add peer deployment ops guide

Document the operational patterns established while adding CT100 and
CT101 as peers via Docker, plus incidental fixes:

- Docker compose template for headless peer containers
- One-off setup key naming convention and API creation
- Peer rename via API PUT (works, unlike setup keys)
- Mac daemon kickstart via 'sudo launchctl kickstart -k system/netbird'
  (service name is 'netbird', not 'io.netbird.client')
- UPNP auto-port-mapping discovery in NetBird client
- CT100 PermitRootLogin drop-in override (first-match-wins sshd quirk)

SUMMARY.md

@@ -85,6 +85,8 @@ reopen fd 8: permission denied
 | peer 之間一直走 Relay，`[stun:...:3478] is Checking...` | STUN port 3478 被 Headscale (`.126`) 搶先佔用 DNAT | NetBird 改用 3479/udp（server config + OpenWrt DNAT）；見 [stun-port-conflict.md](./stun-port-conflict.md) |
 | STUN 都通了，仍然 `Connection type: Relayed`、`ICE candidate: -/-` | 客戶端 **Force Relay Connection** 開關被打開，跳過 ICE gathering | App Settings → Advanced → 關掉 Force Relay；見 [client-troubleshooting.md](./client-troubleshooting.md) |
 | ping RTT 尖峰到 2-4 秒 | 當下 WiFi/ISP 有 bufferbloat | 用 `networkQuality -v` 確認（看 RPM），與 NetBird 無關 |
+| Mac `netbird status` 卡在 `Management: Disconnected, rpc error` | daemon 本身卡死，`netbird up`/`down` 救不回 | `sudo launchctl kickstart -k system/netbird`（服務名是 `netbird` 而非 `io.netbird.client`）；見 [peer-deployment-ops.md](./peer-deployment-ops.md) |
+| LXC CT100 SSH root 密碼被擋（`Permission denied`） | sshd_config 內有 `PermitRootLogin prohibit-password` 比 `yes` 先出現，first-match-wins | 加 `/etc/ssh/sshd_config.d/99-allow-root.conf` 覆蓋；socket activation 不需重啟 sshd |
 
 ## 檔案位置
 
@@ -98,7 +100,8 @@ reopen fd 8: permission denied
 ├── npm-grpc-fix.md                   ← 經 NPM 對外公開時的 gRPC 修復
 ├── setup-keys-and-pat.md             ← Setup Keys / PAT 操作與 API 限制繞道
 ├── stun-port-conflict.md             ← STUN 改用 3479 (3478 被 Headscale 佔用)
-└── client-troubleshooting.md         ← 客戶端 Force Relay / bufferbloat 排錯
+├── client-troubleshooting.md         ← 客戶端 Force Relay / bufferbloat 排錯
+└── peer-deployment-ops.md            ← Docker 部署客戶端、改名、Mac daemon 重啟
 ```
 
 ### 遠端伺服器（192.168.42.127:/opt/netbird/）