remove medium theme, fix navbar re-render, fix Node

DOCKER.md

@@ -179,6 +179,10 @@ REGISTRY_PASSWORD=<personal-access-token-or-deploy-token>
 
 The production compose file now reads `APP_IMAGE` and `APP_VERSION` for pull-based deploys. The GitLab deploy job injects those values automatically. If you want to pull manually on the server, you can also set `APP_IMAGE` in `.env.docker.production`.
 
+The CI pipeline publishes and deploys from the GitLab default branch (`$CI_DEFAULT_BRANCH`). If you change your release branch, update the repository default branch in GitLab instead of hard-coding branch names in `.gitlab-ci.yml`.
+
+If you use `docker:dind` on a self-hosted GitLab runner, the runner's Docker executor must be started with `privileged = true`. Without that, `docker:dind` often logs AppArmor or `/sys/kernel/security` mount errors and can become unreliable even when the job container still starts.
+
 #### 5. Start Traefik
 
 Traefik must be running before the app stack so it can wire up routes at startup.