docs: run/ops instructions in README

Match the README's run docs to the deployed reality: detached Docker Compose
startup with auto-migration, container-management commands, corrected access
URLs (production HTTPS + localhost + WSL-IP caveat), and an in-container test
path for when the local Python toolchain is unavailable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -887,14 +887,32 @@ cd /mnt/c/SyncData/impactflow-discovery
 
 ```bash
 cp .env.example .env
-# edit .env and add ANTHROPIC_API_KEY
-docker compose up --build
+# edit .env: ANTHROPIC_API_KEY (+ GOOGLE_*/JWT_SECRET/IMPACTFLOW_API_KEY for auth);
+# set COOKIE_SECURE=false for local http dev
+docker compose up -d --build discovery
+```
+
+On startup the container runs migrations then uvicorn
+(`python -m app.migration_bootstrap && alembic upgrade head && uvicorn …`), so
+the SQLite schema is brought up to the latest revision automatically.
+
+Manage the running container:
+
+```bash
+docker compose ps                  # status
+docker compose logs -f discovery   # follow logs
+docker compose restart discovery   # restart
+docker compose up -d --build discovery   # apply .env or code changes
+docker compose down                # stop & remove
 ```
 
 Open:
 
-- Discovery flow: <http://100.103.206.4:8011/static/discovery.html>
-- Health check: <http://100.103.206.4:8011/health>
+- Deployed (HTTPS): <https://impactflow.teamci.org:8011>
+- Local (from Windows): <http://localhost:8011> — redirects to the discovery flow
+- Health check: <http://localhost:8011/health>
+- From WSL, `localhost` does not forward in; use the WSL IP (e.g.
+  `http://192.168.245.52:8011`) or the Windows host gateway.
 
 When Docker runs inside WSL and you want the app to behave like the other
 WSL-published services, keep `HOST_BIND_IP=0.0.0.0` in `.env`, then create a
@@ -946,11 +964,21 @@ uvicorn app.main:app --reload --port 8011
 
 ## Tests And Verification
 
-The extractor tests mock Anthropic, so they do not need a real API key or
-network access:
+All Anthropic-backed services (extractor, reflection coach, check-in coach,
+foundation tagger) are mocked in the suite, so the tests need no real API key
+or network access:
 
 ```bash
-.venv/Scripts/python.exe -m pytest
+.venv/Scripts/python.exe -m pytest          # Windows venv
+# or, on macOS/Linux: pytest
+```
+
+If the local Python toolchain is unavailable (e.g. the WSL↔Windows interop is
+down), run the suite inside the image, which has every dependency:
+
+```bash
+docker build -t ifd-test .
+docker run --rm -v "$PWD:/app" --entrypoint python ifd-test -m pytest -q
 ```
 
 `smoke_test.py` drives the whole API in process with `httpx.ASGITransport` and