fix(install): close the four fresh-install-audit findings

README.md

@@ -357,6 +357,10 @@ That is the whole install. A few options if you want them:
   to Docker? This is the hands-off path.
 - **Use native apps** instead of the browser (Windows/macOS desktop, Android). See the
   [client install guide](docs/CLIENTS.md).
+- **Prefer HTTPS?** Caddy also serves the console at `https://<your-server-ip>:8443/admin`, but
+  with an internal self-signed certificate, so your browser warns on the first visit until you
+  trust the CA. Plain `http://<your-server-ip>:8080` on a trusted LAN is fine; for real TLS see
+  [docs/TLS.md](docs/TLS.md).
 - **Build from source** instead of pulling images (you are developing Crumb, running
   air-gapped, or on a fork that has not published images):
   `docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build`

docs/AI-INSTALL.md

@@ -541,7 +541,10 @@ All wizard steps have API equivalents. Do them in order:
    with empty strings for fields you are not changing.)
    (`GET /auth/setup-status` returns a suggested address derived from the request,
    plus `suggested_scan_range`, the server's own `/24`, a good default for the
-   discovery scan below. It's `null` when the console was reached by hostname.)
+   discovery scan below. It's `null` when the console was reached by hostname, and
+   it echoes back `localhost` when you call it from the host itself, so on a
+   headless install set `server_address` to the LAN IP or hostname your phone and
+   desktop apps will actually reach, not whatever this suggests.)
 3. **Storage + retention.** Confirm/adjust the disk via `GET`/`POST /config/storages`,
    optionally preflight the path first with `POST /config/fs/check` `{path}` →
    `{status: "ok"|"warn"|"error", writable, free_bytes, total_bytes, message}`.

scripts/setup-env.sh

@@ -424,7 +424,8 @@ fi
 # instead of assuming, and fail the run when the answer is definitely no.
 # Platform-by-platform notes: docs-site/docs/getting-started/platform-notes.md.
 STORAGE_PREFLIGHT_FAILED=0
-FREE_SPACE_FLOOR_KIB=10485760   # 10 GiB
+FREE_SPACE_FLOOR_KIB=10485760   # 10 GiB (below this: a strong warning)
+ADVISORY_SPACE_KIB=52428800     # 50 GiB (below this but above the floor: a gentle "small for an NVR" note)
 
 # Filesystem type of the mount holding $1. Empty = could not determine (that is
 # a "skip the check", never a failure). GNU stat first, then df -T, then mount.
@@ -563,6 +564,12 @@ if [[ -d "${MEDIA_DIR_HOST}" ]]; then
       log "      Cameras eat terabytes. Point MEDIA_HOST_PATH at a real disk, or set"
       log "      retention low enough that this fills predictably rather than by surprise:"
       log "        MEDIA_HOST_PATH=/mnt/<disk>/crumb scripts/setup-env.sh --force"
+    elif [[ "${MEDIA_FREE_KIB}" -lt "${ADVISORY_SPACE_KIB}" ]]; then
+      log "storage preflight: $(( MEDIA_FREE_KIB / 1048576 )) GiB free at ${MEDIA_DIR_HOST}, which is on"
+      log "      the small side for continuous recording. A single HD camera can use tens of GiB"
+      log "      per day; Crumb evicts oldest footage to stay above its free-space floor, but"
+      log "      plan retention (or point MEDIA_HOST_PATH at a larger disk) so it fills"
+      log "      predictably rather than by surprise."
     else
       log "storage preflight: $(( MEDIA_FREE_KIB / 1048576 )) GiB free at ${MEDIA_DIR_HOST}"
     fi
@@ -655,4 +662,4 @@ if [[ "${STORAGE_PREFLIGHT_FAILED}" -eq 1 ]]; then
   exit 1
 fi
 
-log "NEXT: 'docker compose up -d', then open http://<host>:8080/admin and sign in with the above."
+log "NEXT: 'docker compose pull && docker compose up -d', then open http://<host>:8080/admin and sign in with the above."