harden runtime config and docs

README.md

@@ -311,9 +311,13 @@ The example contains the filesystem and FastCGI settings:
 BIN_DIRECTORY=/var/cache/uce/work
 TMP_UPLOAD_PATH=/var/lib/uce/uploads
 SESSION_PATH=/var/lib/uce/sessions
+SESSION_COOKIE_SECURE=1
 
 FCGI_SOCKET_PATH=/run/uce/fastcgi.sock
+FCGI_SOCKET_MODE=0666
 FCGI_PORT=9993
+CLI_SOCKET_PATH=/run/uce/cli.sock
+CLI_SOCKET_MODE=0600
 
 PRECOMPILE_FILES_IN=
 SITE_DIRECTORY=/var/www/html
@@ -328,7 +332,7 @@ For nginx deployments, the most important setting is:
 
 - `FCGI_SOCKET_PATH=/run/uce/fastcgi.sock`
 
-That is the Unix socket nginx should use for normal `.uce` requests.
+That is the Unix socket nginx should use for normal `.uce` requests. `CLI_SOCKET_PATH` is for local admin/test execution through `scripts/uce-cli`; keep `CLI_SOCKET_MODE=0600` unless a trusted Unix group explicitly needs access.
 
 `FCGI_PORT` is optional if nginx is talking to the Unix socket. Leave it set if you also want a TCP FastCGI listener, or remove it if you want the socket to be the only FastCGI entry point.
 
@@ -350,6 +354,7 @@ Recommended deployment notes:
 
 - keep `HTTP_PORT` bound to localhost only at the firewall or by network policy; nginx should be the public entry point
 - keep `BIN_DIRECTORY`, `TMP_UPLOAD_PATH`, and `SESSION_PATH` on writable local storage
+- use `SESSION_COOKIE_SECURE=1` for HTTPS-only deployments; leave it `0` only for local/plain-HTTP development
 - after editing `/etc/uce/settings.cfg`, restart `uce.service`
 
 ### 4. Install and enable the systemd service
@@ -362,8 +367,8 @@ scripts/systemd/manage-uce-service.sh setup
 
 That script:
 
-- installs `scripts/systemd/uce.service` as `/etc/systemd/system/uce.service`
-- installs `etc/uce/settings.cfg` to `/etc/uce/settings.cfg` if it does not already exist
+- installs `scripts/systemd/uce.service` as `/etc/systemd/system/uce.service`, rewriting the repository-root path in the unit to the checkout you ran it from
+- installs `etc/uce/settings.cfg` to `/etc/uce/settings.cfg` if it does not already exist, likewise rewriting checkout-root paths
 - reloads systemd
 - enables the service at boot
 - starts the runtime immediately