Agent host: SilverBullet serves the vault as its one space, behind Authelia

The operator chose single-space mode: the vault is mounted at /data, with
memory/ read-only over it, and there are no accounts or setup wizard;
Authelia in the operator's Caddy is the login. SB_NAME forces the mode, so
an empty vault can't boot the wizard. SilverBullet's own data folder is
gone. check now fails if the wizard could be open. The README says how to
make memory/ writable for a while and back.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

deploy/agent-host/check.sh

@@ -11,18 +11,18 @@ cd "$stack" || { echo "FAIL: no $stack"; exit 1; }
 [ "$(sudo docker compose ps --status running -q | wc -l)" -ge 1 ] \
   && ok "SilverBullet is running" || bad "SilverBullet isn't running"
 if sudo docker compose logs --no-color silverbullet 2>/dev/null | grep -q 'boot mode: single-space'; then
-  bad "it booted a single space with no accounts (an SB_* setting?)"
+  ok "it serves the vault as one space (no setup wizard)"
 else
-  ok "it keeps accounts (no single-space boot)"
+  bad "it didn't boot one space: the setup wizard may be open"
 fi
 code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/)
 case $code in 2??|3??) ok "it answers locally ($code)" ;; *) bad "it answers $code" ;; esac
 probe=.nisse-probe-$$
 sudo docker compose exec -T -u 1000 silverbullet \
-  sh -c "touch /vault/infrastructure/$probe && rm /vault/infrastructure/$probe" \
+  sh -c "touch /data/infrastructure/$probe && rm /data/infrastructure/$probe" \
   && ok "the operator's folders are writable" || bad "the operator's folders aren't writable"
-if sudo docker compose exec -T silverbullet sh -c "touch /vault/memory/$probe" 2>/dev/null; then
-  sudo docker compose exec -T silverbullet rm -f "/vault/memory/$probe"
+if sudo docker compose exec -T silverbullet sh -c "touch /data/memory/$probe" 2>/dev/null; then
+  sudo docker compose exec -T silverbullet rm -f "/data/memory/$probe"
   bad "memory/ is writable from SilverBullet, even as root in it"
 else
   ok "memory/ is read-only to SilverBullet"