fix(deploy): make portal installer runtime portable

www/README.md

@@ -616,9 +616,10 @@ for those explicit builds. No actual submissions run in automated tests.
 The Contabo deployment interface is intentionally separate from NixOS changes.
 Use [the release runbook](integrations/nixos/deploy.md) for `npm run deploy`,
 dry-run, rollback, the encrypted production portal input and the separate
-one-time employee-resource installer. Ordinary releases never copy employee
-documents into `dist`; protected staff and management resources remain under
-server-controlled Basic Auth namespaces. The accepted interim portal is
+one-time employee-resource installer. The server-side installer is a root-only
+POSIX shell script using NixOS base tools; it does not require Node.js on
+Contabo. Ordinary releases never copy employee documents into `dist`;
+protected staff and management resources remain under server-controlled Basic Auth namespaces. The accepted interim portal is
 explicitly non-PHI.
 
 ### Google Ads consultation-form conversion handoff