feat(ci): automated docker update script + nightly cron

- scripts/docker-update.sh: git pull --ff-only, host db:migrate, docker compose
  build + up -d, health-check wait, keeps host-side PM2 'next' stopped.
  Fails safe on dirty working tree (exit 1) and on health failure (exit 3).
- cron entry: daily 03:30 -> logs/docker-update.cron.log
- README: Automatic Updates section + docker commands row

README.md

@@ -154,6 +154,29 @@ The CMS will be available at `http://localhost:3002`.
 
 > **Reverse proxy:** This setup is designed to run behind the existing nginx on the host. nginx serves the Nitro/Octane client (`/client/`, `/nitro-client/`) and `/gamedata/` directly from `/var/www/Octane/dist` and `/var/www/Gamedata`, and proxies `/` to the CMS on `127.0.0.1:3002`. Point `APP_URL`/`NEXT_PUBLIC_APP_URL` at the public site URL.
 
+### Automatic Updates
+
+A cron-safe update script is included: `scripts/docker-update.sh`. It pulls the
+latest `main`, runs CMS migrations on the host, rebuilds the image, recreates the
+container, waits for a healthy status, and makes sure the stale host-side PM2 CMS
+(`pm2 stop next`) stays stopped so it can't clash on port 3002.
+
+```bash
+./scripts/docker-update.sh           # run once manually
+# log: logs/docker-update.log
+```
+
+Set it up as a nightly cron job (03:30 example):
+
+```bash
+crontab -e
+# 30 3 * * * /var/www/atom-nexst/scripts/docker-update.sh >> /var/www/atom-nexst/logs/docker-update.cron.log 2>&1
+```
+
+The script aborts safely (exit 1) if the working tree has uncommitted changes so
+a `git pull` can never clobber local edits, and leaves the container running if
+health fails so you can debug it (exit 3).
+
 ### Docker Commands
 
 | Command                                    | Description                          |
@@ -165,6 +188,7 @@ The CMS will be available at `http://localhost:3002`.
 | `docker compose restart cms`               | Restart the CMS container            |
 | `docker compose pull && docker compose up -d --build` | Update and redeploy     |
 | `pnpm db:migrate` (on the **host**)        | Run database migrations (slim image has no source) |
+| `./scripts/docker-update.sh`               | Full automated update (manual or cron) |
 
 ### How Package Manager Detection Works