docs: add development workflow section to README

Document the CI/CD pipeline: edit locally in /root/code/cinny, commit and
push to origin/lotus, Gitea Actions builds (~11 min), webhook triggers
lotus_deploy.sh which gates on CI pass before deploying to /var/www/html/.
Note that LXC credential is read-only; pushes require manual auth from dev box.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -136,6 +136,21 @@ Vite's render-chunks phase requires ~6 GB Node heap. If OOM killed, set:
 NODE_OPTIONS=--max_old_space_size=6144 npm run build
 ```
 
+## Development workflow
+
+All code changes should be made in the local clone at `/root/code/cinny` on the dev box, then committed and pushed to `origin/lotus`. The CI/CD pipeline handles everything from there — no manual build or deploy steps needed.
+
+```
+edit → commit → git push    # ~11 minutes → auto-deployed to chat.lotusguild.org
+```
+
+Pipeline (`.gitea/workflows/ci.yml` + `lotus_deploy.sh` on LXC 106):
+1. Push triggers a Gitea Actions build — TypeScript check, ESLint, Prettier, bundle size report
+2. Build must pass as the CI gate; quality checks are informational (`continue-on-error`)
+3. A Gitea webhook fires `lotus_deploy.sh` on LXC 106, which polls the API until CI passes (up to 15 min), then pulls `origin/lotus`, runs `npm ci && npm run build`, and rsyncs to `/var/www/html/`
+
+LXC 106's stored Gitea credential is **read-only** — it can only pull. Pushes must be done from the dev box with your personal credentials (entered manually, never cached).
+
 ## Deployment
 
 Built files are served from `/var/www/html/` on LXC 106 (nginx). Config lives at `/opt/lotus-cinny/config.json` (vite copies it to `dist/`):