docs: record Gate 0.8 resolution + Gate 0.9 LinkedIn app / CMA progress

- deferred-gates.md: Gate 0.8 RESOLVED — clean-room Postgres 17 + Redis 7 in a
  dedicated Dokploy project; service names, hosts, env-var locations recorded.
- linkedin-apps.md: app created (Client ID 78s8f53y5spyo4), company-page +
  business-email verified, Community Management API Development Tier submitted
  (review in progress). Notes that other products grey out while CMA is pending.
- docs/handoffs/2026-05-13-handoff.md: committed (was untracked).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/deferred-gates.md

@@ -4,15 +4,37 @@ Items that could not be completed in the Stage 0 execution window and must be re
 
 ## Gate 0.8 — Postgres + Redis on PaaS
 
-**Status:** Deferred 2026-04-19.
-**Reason:** Dokploy MCP tools (`mcp__dokploy__*`) were not loaded in the Stage 0 session, and `DOKPLOY_API_KEY` was not in the WSL environment. Direct API query not possible in-session.
-**Blocks:** Stage 2 (database + API) — the scheduler and admin cannot run without a Postgres + Redis pair.
-**Resolution options:**
-1. **Recommended:** Restart Claude Code with the vault's `.mcp.json` Dokploy MCP attached; run `mcp__dokploy__list_applications` / equivalent against `sg-paas-s1.stargue.net` to verify or provision.
-2. Angelo confirms via Dokploy web UI and reports service names + connection hostnames.
-3. Provision fresh Postgres + Redis services in the `stargue-publishing-engine` Dokploy stack (clean room; isolates blast radius from other PaaS apps).
+**Status:** ✅ RESOLVED 2026-06-03 (via Dokploy MCP, resolution option 3 — clean-room stack).
+**Reason (historical):** Dokploy MCP tools (`mcp__dokploy__*`) were not loaded in the Stage 0 session, and `DOKPLOY_API_KEY` was not in the WSL environment. Direct API query not possible in-session.
+**Blocks (now cleared):** Stage 2 (database + API) — the scheduler and admin cannot run without a Postgres + Redis pair.
 
-**Acceptance when resolved:** this file updated with service names, hostnames, and connection-string env-var locations (Dokploy secrets).
+### Resolution (2026-06-03)
+
+Provisioned a dedicated clean-room Dokploy project on `sg-paas-s1.stargue.net`, isolating blast radius from other PaaS apps (option 3).
+
+| Item | Value |
+|---|---|
+| Dokploy project | `stargue-publishing-engine` (`projectId: Y6R_4ML2N0Vsztk0UVi1W`) |
+| Environment | `production` (`environmentId: hkvob7vx02lzkn3GhpHMD`) |
+| Postgres service | "Publishing Engine Database" (`postgresId: O_BjqkxljdMU3xLb3q09M`) — image `postgres:17`, status `done` |
+| Postgres internal host | `stargue-pubeng-postgres-n9c1gc` (Docker network alias) port `5432` |
+| Postgres db / user | `publishing_engine` / `publishing_engine` |
+| Postgres volume | `stargue-pubeng-postgres-n9c1gc-data` → `/var/lib/postgresql/data` |
+| Redis service | "Publishing Engine Redis" (`redisId: fZR9Bdx8-3d99uOrrqFe5`) — image `redis:7`, status `done` |
+| Redis internal host | `stargue-pubeng-redis-9tebfd` (Docker network alias) port `6379` |
+| Redis volume | `stargue-pubeng-redis-9tebfd-data` → `/data` |
+
+**Connection-string env-var locations (NOT stored in git):**
+- `DATABASE_URL` = `postgres://publishing_engine:<PG_PASSWORD>@stargue-pubeng-postgres-n9c1gc:5432/publishing_engine`
+- `REDIS_URL` = `redis://default:<REDIS_PASSWORD>@stargue-pubeng-redis-9tebfd:6379`
+- Secret **values** live in Dokploy (retrieve via `mcp__dokploy__postgres-one` / `mcp__dokploy__redis-one`). They will be injected as Dokploy secrets on the **app** services (`apps/mcp-linkedin`, `apps/scheduler`, `apps/admin`) once those are created in Stage 5+. No app service exists yet, so there is nowhere to attach them today.
+
+**Remaining to fully unblock live DB tests:**
+1. Run `0000_initial_schema.sql` against the new DB. The internal hostname is only resolvable inside the Dokploy Docker network, so either (a) temporarily add an external port via `mcp__dokploy__postgres-saveExternalPort` and run `bun run db:migrate` from WSL with the external `DATABASE_URL`, then remove the port; or (b) run the migration from a one-shot container inside the stack.
+2. Run `bun run db:migrate:rehearse` (forward-then-rollback row-count hash check).
+3. Re-enable `INTEGRATION=1`-gated tests with the connection strings wired.
+
+**Acceptance (met):** service names, hostnames, and connection-string env-var locations recorded above; secret values held in Dokploy, not committed.
 
 ## Gate 0.9 — LinkedIn Developer Portal apps