serving: defaults.env header + Makefile + .gitignore + doc refs

Completes the rename commit (which carried only the file move): defaults.env
layering header, docker-compose usage comment, serving/Makefile (sets
COMPOSE_ENV_FILES), serving/.gitignore (.env), and the README/TODO references.

serving/Makefile

@@ -0,0 +1,45 @@
+# Makefile — convenience wrapper for the serving stack.
+#
+# Sets COMPOSE_ENV_FILES so `make up` / `make logs` / etc. layer the committed
+# defaults.env UNDER your .env overrides automatically — no need to export it or
+# pass --env-file. (Plain `docker compose …` still works if you export
+# COMPOSE_ENV_FILES=defaults.env,.env yourself.) Run from serving/.
+
+export COMPOSE_ENV_FILES := defaults.env,.env
+
+COMPOSE := docker compose
+SERVICE ?=
+
+.DEFAULT_GOAL := help
+
+.PHONY: help up down restart pull logs ps config
+
+help: ## Show this help
+	@grep -hE '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) \
+	  | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-12s\033[0m %s\n", $$1, $$2}'
+
+# .env must exist because COMPOSE_ENV_FILES lists it — guard with a clear message.
+.env:
+	@echo "ERROR: .env not found — create it with your per-LAN overrides (BOOT_IFACE / SERVER_IP / DHCP range / IMAGE_VERSION; see defaults.env)." >&2
+	@exit 1
+
+up: .env ## Start the stack (dnsmasq + http + nvmeof)
+	$(COMPOSE) up -d
+
+down: .env ## Stop + remove the stack
+	$(COMPOSE) down
+
+restart: .env ## Recreate a service (SERVICE=dnsmasq) or all
+	$(COMPOSE) up -d --force-recreate $(SERVICE)
+
+pull: .env ## Pull the CI-built images
+	$(COMPOSE) pull
+
+logs: .env ## Follow logs (SERVICE=dnsmasq for one)
+	$(COMPOSE) logs -f $(SERVICE)
+
+ps: .env ## Show container status
+	$(COMPOSE) ps
+
+config: .env ## Print the resolved (layered) compose config
+	$(COMPOSE) config