Add keep overview command and a docker-compose deploy wrapper

keep overview gives an admin a cross-vault view of every recipient and
grant in one screen, instead of walking vaults one at a time via
/vaults/:key/recipients. scripts/deploy.sh pulls a project's env from
keep before running docker compose up, for VPS deploys of several
docker-compose projects.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

INTEGRATION.md

@@ -31,6 +31,33 @@ A deploy identity should almost always be granted **read-only** access
 needs to `pull`, and a read-only grant means a compromised deploy box
 can't also rotate the vault or add itself more recipients.
 
+## Pattern: several docker-compose projects on one or more VPSes
+
+The common shape once more than one or two projects are on `keep`:
+each project lives in its own directory on the VPS
+(`/opt/docker/<project>/docker-compose.yml`), and "deploy" means pulling
+that project's env and running `docker compose up -d` in its directory.
+`scripts/deploy.sh` in this repo is a small generic wrapper for exactly
+that:
+
+```bash
+./deploy.sh myapp              # pulls myapp/production, runs compose in /opt/docker/myapp
+./deploy.sh myapp staging      # pulls myapp/staging instead
+DEPLOY_ROOT=/srv/apps ./deploy.sh myapp   # different project root
+```
+
+One-time setup per VPS: `keep identity init` on that machine, register
+its public key with `keep recipient add`, `keep identity set-id`, then
+grant it **read-only** access to each project vault it deploys
+(`keep grant <project>/production <vps-recipient-id> --read-only`). After
+that, `./deploy.sh <project>` is the whole deploy step — no `.env`
+hand-copied onto the box first.
+
+For "which machine can deploy which project," `keep overview` (admin)
+prints every vault and every recipient's access in one screen — the
+thing to reach for instead of checking each vault's grants one at a
+time.
+
 ## Pattern: docker-compose reading a local `.env`
 
 A common shape — `docker compose up -d` reads `environment:` values from