docs: Caddy manual override + OnlyOffice MCP SSE investigation (#92)

Record the Caddy reverse-proxy at /etc/caddy/ (14 *.localhost sites,
mkcert TLS, systemd caddy.service) as a manual override in
docs/tech/manual-overrides.md - no caddy Ansible role exists yet.

Add a 'Local Dev Services' section to docs/tech/stack.md listing all
*.localhost sites and useful Caddy commands.

New learning record docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-
investigation.md: Caddy emits 'context canceled' SSE aborts (~1.5ms) on
onlyoffice.localhost/mcp -> localhost:3847. Upstream verified alive
(HTTP 406 to plain GET = expected). Handed off to GitLab issue
satware/mcp/onlyoffice#92 with 5 hypotheses, 7 tasks, and a proposed
flush_interval -1 + transport http { versions 1.1 } mitigation (not
applied yet to avoid masking root cause).

docs/tech/stack.md

@@ -6,7 +6,7 @@ tags:
   - software-stack
   - inventory
   - tech-stack
-last_updated: '2026-06-17'
+last_updated: '2026-07-06'
 ---
 
 # Software Stack - mw-pfeddersheim-workstation
@@ -92,3 +92,44 @@ Packages previously listed as "Misc" reclassified to functional domains:
 - **Ansible**: `/usr/bin/ansible`
 - **Python**: `/usr/bin/python`
 - **Docker**: `/usr/bin/docker`
+
+## Local Dev Services (Manual - not Ansible-managed)
+
+System-level services running on this workstation that are configured manually
+outside this repo's Ansible roles. See `docs/tech/manual-overrides.md` for the
+full override table and `docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-investigation.md`
+for the active Caddy/OnlyOffice investigation.
+
+### Caddy (port 443, systemd `caddy.service`)
+
+| Item | Value |
+|------|-------|
+| Package | `caddy` (pacman) |
+| Service | `caddy.service` (enabled, runs as `caddy` user) |
+| Config | `/etc/caddy/Caddyfile` + `/etc/caddy/conf.d/localhost-dev.conf` |
+| TLS | mkcert-generated pair at `/etc/caddy/localhost{,-key}.pem` |
+| Admin endpoint | Unix socket `/run/caddy/admin.socket` |
+| Sites | 14 `*.localhost` virtual hosts (see table below) |
+
+#### `*.localhost` sites
+
+| Site | Backend / Handler | Notes |
+|------|-------------------|-------|
+| `mcp.localhost` | `reverse_proxy localhost:50880` | MCP server (node, pid 1167) |
+| `artifacts.localhost` | `file_server browse` root `/var/www/artifacts` | Static artifacts |
+| `onlyoffice.localhost` | `reverse_proxy localhost:3847` | OnlyOffice MCP server; emitting `context canceled` SSE aborts (issue [#92](https://gitlab.satware.com/satware/mcp/onlyoffice/-/work_items/92)) |
+| `project-1.localhost` ... `project-10.localhost` | `respond "project-N - placeholder"` | 10 reserved placeholders |
+| `demo.satware.com.localhost` | `reverse_proxy localhost:38081` | webdevops/php-apache-dev container |
+
+Wildcard cert covers one level only. `demo.satware.com.localhost` works
+(single label under `*.localhost`); deeper nesting (e.g.
+`sub.demo.satware.com.localhost`) would NOT be covered.
+
+### Useful Caddy commands
+
+```bash
+sudo caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
+sudo systemctl reload caddy
+sudo journalctl -u caddy --no-pager -n 50
+curl -sk https://onlyoffice.localhost/ping   # test (skips cert verify)
+```