docs: explain self-hosting, content import and safe upgrades

tasks/portfolio-builder.md

@@ -0,0 +1,23 @@
+# Portfolio builder implementation
+
+Approved architecture: one Next.js Node application, SQLite/Drizzle, Better Auth,
+and persistent local uploads. One owner, save publishes, arbitrary languages,
+default language at root, existing design and fixed section order.
+
+- [x] Database, migrations, validated content schemas and generic seed
+- [x] Owner provisioning, recovery, sessions and protected management APIs
+- [x] Database-backed public rendering, languages and dynamic project URLs
+- [x] Structured admin forms, media management and translation editing
+- [x] Current-site import, container startup, backup/restore and deployment docs
+- [ ] Integration, browser, production build and container verification
+
+Acceptance: owners can change every portfolio field and public label without
+editing source or rebuilding. Save changes fresh public HTML; private APIs remain
+protected. Container replacement and backup restoration retain data and media.
+
+Verification recorded 2026-09-15: production build and all 24 Node tests passed;
+browser suite passed 13 checks, with the mobile-only native-sharing check skipped
+on desktop. Content/security tests passed again before committing. Container
+verification remains open: dependency installation required a native compiler;
+the Docker build stage now includes Python, make, and g++, but the image and
+replacement-persistence smoke check have not yet been rerun successfully.