feat: use host bind mounts for persistent data

README.md

@@ -31,6 +31,7 @@ No host PHP, database, Node.js, or WordPress installation is required.
 
 ```bash
 cp .env.example .env
+./scripts/prepare-host-volumes.sh
 docker compose up --build -d
 docker compose --profile tools run --rm wp-cli /scripts/bootstrap.sh
 docker compose ps
@@ -44,6 +45,20 @@ Open:
 Use the development credentials copied into `.env` only locally. Change them before
 sharing the environment.
 
+Persistent data uses host-based bind mounts by default:
+
+- `./runtime/db` for MariaDB;
+- `./runtime/wordpress` for WordPress core, uploads, themes, and mu-plugins copied at
+  container startup;
+- `./runtime/letsencrypt` for certificates;
+- `./runtime/certbot/www` for ACME HTTP-01 challenges.
+
+Run `./scripts/prepare-host-volumes.sh` before the first start, especially on Linux
+hosts. The script reads `.env`, creates the directories, and assigns the expected
+container owners (`999:999` for MariaDB, `33:33` for WordPress, `0:0` for Certbot).
+Override the `*_DATA_PATH` and `*_VOLUME_UID/GID` variables in `.env` if your runtime
+uses different host paths or image user IDs.
+
 ## Edit content
 
 - **Appearance > Customize**: hero, manifesto, laboratory, teacher, lessons, contacts,
@@ -109,10 +124,10 @@ docker compose config --quiet
 Back up the database and WordPress files at the same logical point in time:
 
 ```bash
-mkdir -p backups/wordpress-files
 docker compose stop wordpress
+mkdir -p backups
 docker compose exec -T db sh -c 'mariadb-dump -u root -p"$MARIADB_ROOT_PASSWORD" "$MARIADB_DATABASE"' > backups/database.sql
-docker compose cp wordpress:/var/www/html/. backups/wordpress-files/
+tar -C runtime -czf backups/wordpress-files.tgz wordpress
 docker compose start wordpress
 ```
 
@@ -121,6 +136,7 @@ Do not commit backups or `.env`. Encrypt and test real backups off-host. See
 
 ## Rollback
 
-Revert the application commit and rebuild containers. Preserve `db_data`,
-`wordpress_data`, and certificate volumes. Database restoration is a separate,
-destructive operation and requires a verified backup.
+Revert the application commit and rebuild containers. Preserve the host directories
+configured by `DB_DATA_PATH`, `WORDPRESS_DATA_PATH`, `LETSENCRYPT_DATA_PATH`, and
+`CERTBOT_CHALLENGES_PATH`. Database restoration is a separate, destructive operation
+and requires a verified backup.