begin embedded pds with xrpc endpoints and well-known

deploy/docker-compose.prod.yml

@@ -98,6 +98,10 @@ services:
       HOLD_PUBLIC: ${HOLD_PUBLIC:-false}
       HOLD_OWNER: ${HOLD_OWNER}
 
+      # Embedded PDS configuration
+      HOLD_DATABASE_DIR: ${HOLD_DATABASE_DIR:-/var/lib/atcr-hold}
+      # HOLD_KEY_PATH: ${HOLD_KEY_PATH}  # Optional, defaults to {HOLD_DATABASE_DIR}/signing.key
+
       # Storage driver
       STORAGE_DRIVER: ${STORAGE_DRIVER:-s3}
 
@@ -113,10 +117,8 @@ services:
       # STORAGE_DRIVER: filesystem
       # STORAGE_ROOT_DIR: /var/lib/atcr/hold
     volumes:
-      # Only needed for filesystem driver
-      # - atcr-hold-data:/var/lib/atcr/hold
-      # OAuth token storage for hold registration
-      - atcr-hold-tokens:/root/.atcr
+      # PDS data (carstore SQLite + signing keys)
+      - atcr-hold-data:/var/lib/atcr-hold
     networks:
       - atcr-network
     healthcheck: