Merge branch 'admin-panel'

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

# Conflicts:
#	docs/deployment.md

docs/deployment.md

@@ -86,7 +86,10 @@ Service. Its image is built separately, also from the repository root:
 
 ```sh
 docker build -t registry.example.org/warp-admin:0.10.0 -f apps/admin/Dockerfile .
-helm upgrade warp deploy/helm/warp --reuse-values   --set admin.enabled=true   --set admin.image.repository=registry.example.org/warp-admin   --set admin.image.tag=0.10.0
+helm upgrade warp deploy/helm/warp --reuse-values \
+  --set admin.enabled=true \
+  --set admin.image.repository=registry.example.org/warp-admin \
+  --set admin.image.tag=0.10.0
 ```
 
 Without an ingress, reach it with `kubectl port-forward svc/warp-admin
@@ -96,11 +99,31 @@ reaches `/_warp/admin` inside the cluster, so you can then drop `/_warp`
 from `ingress.hosts[].paths`. `admin.resources` and `admin.replicas` are in
 `values.yaml`.
 
+## Admin panel
+
+The admin panel is optional and is not part of the `warp` binary. It is a
+separate service, `warp-admin`, that serves the panel and proxies the
+login endpoints and `/_warp/admin/v1` to the homeserver. Install it only
+if you want it:
+
+```sh
+cd deploy/compose
+docker compose --profile admin up -d    # http://localhost:8009
+```
+
+Or build the image (`make admin-docker`) or the binary (`make admin`) and
+point it at the homeserver with `WARP_ADMIN_HOMESERVER`. Since only
+warp-admin needs `/_warp/admin`, your public proxy can leave that path out
+and keep the panel on an internal hostname. See
+[apps/admin](../apps/admin/README.md).
+
 ## Reverse proxy
 
 Behind a proxy that terminates TLS:
 
-- Route `/_matrix`, `/.well-known/matrix` and `/_warp` to Warp.
+- Route `/_matrix` and `/.well-known/matrix` to Warp. Route `/_warp` too
+  only if something outside reaches the admin API directly; warp-admin
+  talks to Warp over its own connection.
 - Keep the proxy's read timeout above `sync.long_poll_timeout` (30 s), or
   every idle `/sync` is cut off.
 - Allow request bodies of `media.max_upload_bytes` (50 MiB by default).