docs: add §17 Infrastructure — cluster topology, Odoo 19 porting notes, secrets, runboat

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -1052,4 +1052,59 @@ Infrastructure / Documentation** as applicable.
 **Add Phase 4 (Playwright, migration testing) when ≥ 2:**
 - Production incident that automated testing would have caught
 - Odoo upgrade requires emergency rollback
+
+---
+
+## 17. Infrastructure (ITSulu Cluster)
+
+### Deployment topology
+
+| Service | Namespace | URL |
+|---------|-----------|-----|
+| Blog Publisher (Odoo 19) | `blog-publisher` | `https://blog.itsulu.com` |
+| Runboat CI | `runboat` | `https://runboat.itsulu.com` |
+| Forgejo | `forgejo` | `https://git.itsulu.com` |
+| Runboat build namespace | `itsulu-testing` | `*.runboat.itsulu.com` |
+
+### Odoo 19 porting notes (learned 2026-05-30)
+
+These fields/tags were removed in Odoo 17+ and will cause `ParseError` on first install if present:
+
+| Old (≤16) | New (17+) | File type |
+|-----------|-----------|-----------|
+| `<tree>` | `<list>` | view XML |
+| `view_mode="tree,form"` | `view_mode="list,form"` | action XML |
+| `<group expand="0" string="Group By">` in `<search>` | `<separator/>` then bare `<filter>` | search view XML |
+| `target="inline"` on `ir.actions.act_window` | `target="current"` | action XML |
+| `numbercall` field on `ir.cron` | removed — omit entirely | data XML |
+
+### Docker image build
+
+The `19.0` Docker image is built manually from this repo root and pushed directly:
+```bash
+docker build -t registry.gitlab.com/itsulu-odoo/itsulu-blog-publisher:19.0 .
+docker push registry.gitlab.com/itsulu-odoo/itsulu-blog-publisher:19.0
+```
+CI `build_image` job only runs on `main` and `merge_requests`. Branch `19.0` is built locally until a `main` branch is established or CI is updated.
+
+### Secrets management
+
+All secrets are in Vault (`itsulu/*` path), synced by ESO `ClusterSecretStore/css-vault`.
+Namespaces must be listed in `kubernetes/eso/css.yaml` `spec.conditions[0].namespaces` to use ESO.
+
+The `gitlab/dockerconfigjson` Vault key must store `dockerconfigjson` as the property name,
+and the ESO ExternalSecret must use `secretKey: .dockerconfigjson` + `property: dockerconfigjson`
+(NOT the `template.data` approach which adds a broken `{"dockerconfigjson":"..."}` wrapper).
+
+### Runboat integration
+
+The `runboat_tag` CI stage (`.gitlab-ci.yml`) fires on `19.0` and `main` after `build_image`:
+1. Tags the commit-SHA image with the branch slug (`registry…:19-0`)
+2. POSTs to `$RUNBOAT_BASE_URL/api/v1/builds` to trigger a live test instance
+
+Runboat is a fork of `sbidoul/runboat` at `gitlab.com/itsulu-odoo/runboat` with two added
+env vars: `RUNBOAT_FORGE_API_BASE_URL` and `RUNBOAT_FORGE_WEB_BASE_URL` (defaults to GitHub;
+set to `https://git.itsulu.com/api/v1` and `https://git.itsulu.com` for Forgejo).
+
+The upstream PR branch is `forgejo-configurable-base-url` on `gitlab.com/itsulu-odoo/runboat`.
 - Team says "I don't trust the test suite"