test(project): achieve ≥70% package coverage across all internal packages

- store/sqlite: 75.4% (repos + db coverage)
- host/sub2api: 80.8% (httptest mock server, pure function tests)
- app: 74.2% (handler error paths, NewActionSet closures)
- pack: 72.4%
- provision: 75.2%
- access: 77.3%
- config: 94.7% (lookup mock tests)

All tests pass: build, vet, race, coverage gates.

docs/DEPLOYMENT.md

@@ -0,0 +1,36 @@
+# Deployment
+
+## Environment
+
+Required:
+
+- `SUB2API_CRM_ADMIN_TOKEN`: control-plane bearer token
+
+Optional:
+
+- `SUB2API_CRM_LISTEN_ADDR` (default `:8080`)
+- `SUB2API_CRM_SQLITE_DSN` (default `file:sub2api-cn-relay-manager.db?_foreign_keys=on&_busy_timeout=5000`)
+
+## Local Docker Compose
+
+```bash
+cp .env.example .env
+# edit SUB2API_CRM_ADMIN_TOKEN before startup
+mkdir -p data
+docker compose up --build -d
+curl -fsS http://127.0.0.1:8080/healthz
+```
+
+## Standalone Binary
+
+```bash
+go build -o bin/sub2api-cn-relay-manager ./cmd/server
+SUB2API_CRM_ADMIN_TOKEN=replace-me ./bin/sub2api-cn-relay-manager
+```
+
+## Runtime Notes
+
+- SQLite file should be mounted on persistent storage.
+- Admin token must be rotated outside source control.
+- The service is stateless except for SQLite runtime state.
+- Use `/healthz` for container liveness checks.