M8-T20: document and validate WarmteLink deployment

docker-compose.warmtelink.yml

@@ -0,0 +1,17 @@
+# Optional WarmteLink serial overlay. Use only together with docker-compose.yml:
+#   WARMTELINK_DEVICE_PATH=/dev/serial/by-id/<stable-by-id-name> \
+#   WARMTELINK_SERIAL_GID=<host-serial-gid> \
+#   docker compose -f docker-compose.yml -f docker-compose.warmtelink.yml up -d
+#
+# Keep the stable /dev/serial/by-id path on the host: /dev/ttyUSB* names may
+# change after a reboot. pyserial opens POSIX serial devices with O_RDWR, so
+# Docker must grant the device cgroup rule rw (never m). This is only the
+# system permission required to open the fd: the WarmteLink worker itself only
+# calls read/close and has no write path. The base compose non-root user stays
+# in effect; this overlay grants neither root nor privileged mode.
+services:
+  app:
+    devices:
+      - "${WARMTELINK_DEVICE_PATH:?Set a stable /dev/serial/by-id path}:/dev/warmtelink:rw"
+    group_add:
+      - "${WARMTELINK_SERIAL_GID:?Set the host serial device GID}"