self-host-guidelisted

Walk the user through standing up their **own** capx chokepoint — the one self-hostable image that holds the KMS-encrypted token vault and runs the casserole guard server-side at every send. This is a **guide**: you read the repo and point at real files. **Do not invent commands or env vars** — everything below traces to a file in this repo; if something isn't there, say so instead of guessing. User's host/intent, if any: "$ARGUMENTS" Follow these steps: 1. **Read the real self-host story first.** Open `docs/P1-CHOKEPOINT.md` §8 (self-host, honest) and §1 (architecture in one picture), plus `services/chokepoint/README.md`. These are ground truth. The honest claim is **"one code path, one mode flag — but N required secrets and a public HTTPS domain,"** *not* "compose up and you're done." Hosted-capx and any self-hoster run the **identical** image; the only difference is configuration. Don't promise the user a one-liner. 2. **Confirm the things they must bring.** Self-host = **BYO-only** (they pay X directly; no capx secret, no MoR, no counter). They need: (a) a host that runs the image (`services/chokepoint/Dockerfile`, or `node --experimental-strip-types services/chokepoint/src/serve.ts` — `serve.ts` honors `$PORT`, so Railway/Render/Fly/Heroku route to it with no port config); (b) **one Postgres** — `VAULT_DB_URL` (no Redis in P1); (c) a **KMS key or local key** — `KMS_KEY_ID`; (d) their **own X app**; (e) a **public HTTPS URL** for `OAUTH_CALLB