Move adolf config to agap_git root (kb#65)

Relocate the OpenClaw gateway config from openai/adolf/ to adolf/ at
the repo root, since it's shared config rather than part of the
openai/ compose project's own tree. Update the docker-compose.yml
bind-mount path (./adolf/openclaw.json -> ../adolf/openclaw.json) and
comments, plus README.md references, to match. Verified: adolf
container recreated healthy with the new bind-mount source resolving
to /home/alvis/agap_git/adolf/openclaw.json, and a fresh
openclaw.json.last-good snapshot confirms the config was accepted.

openai/docker-compose.yml

@@ -121,12 +121,17 @@ services:
       - "host.docker.internal:host-gateway"
     restart: unless-stopped
 
-  # Adolf — OpenClaw fork (Matrix-first personal assistant). Runtime config
-  # (Matrix channel, SOUL.md, model provider -> adolf-llm:8010, MCP registry,
-  # gateway.tools.allow for cron/nodes) is wired in P6 and lives in the
-  # adolf-state VOLUME (openclaw.json + SOUL.md), not in this repo. Matrix
-  # creds and ADOLF_KEY come from openai/.env (gitignored, never committed).
-  # Source: /home/alvis/adolf.
+  # Adolf — OpenClaw fork (Matrix-first personal assistant). The OpenClaw
+  # gateway config (Matrix channel + allow-list, model provider ->
+  # adolf-llm:8010, MCP registry, gateway.tools.allow for cron/nodes) is
+  # version-controlled at agap_git/adolf/openclaw.json (repo root, alongside
+  # this openai/ project, not nested inside it) and bind-mounted read-only
+  # over the adolf-state volume (see volumes below), so git is the single
+  # source of truth — not a hand-edited volume file. The volume still
+  # holds runtime state only (Matrix crypto/devices, credentials, sessions,
+  # workspace/SOUL.md, logs). Matrix creds and ADOLF_KEY come from
+  # openai/.env (gitignored, never committed). Source tree: /home/alvis/adolf.
+  # To change config: edit ../adolf/openclaw.json + restart adolf.
   adolf:
     build:
       context: ../../adolf
@@ -149,9 +154,22 @@ services:
       - MATRIX_USER_ID=${MATRIX_USER_ID:-}
       - MATRIX_PASSWORD=${MATRIX_PASSWORD:-}
       - MATRIX_DEVICE_NAME=${MATRIX_DEVICE_NAME:-Adolf OpenClaw Gateway}
+      # marketplace-mcp bearer token (kb task #61) -- referenced by
+      # openclaw.json's mcp.servers.marketplace.headers.Authorization via
+      # ${MARKETPLACE_MCP_TOKEN} substitution; never inlined into that file.
+      - MARKETPLACE_MCP_TOKEN=${MARKETPLACE_MCP_TOKEN:-}
       - TZ=Europe/Riga
     volumes:
+      # Runtime state only (Matrix crypto/devices, credentials, sessions,
+      # workspace, logs). The gateway config file itself is overlaid below.
       - adolf-state:/home/node/.openclaw
+      # Version-controlled OpenClaw gateway config, mounted read-only on top
+      # of the state volume so it is the single source of truth. The gateway
+      # reads this JSONC file and snapshots its own .last-good/.rejected
+      # copies into the volume dir (writable) — it never rewrites this file,
+      # so read-only is safe. Edit the tracked file + restart to change config;
+      # runtime/UI edits are intentionally disabled by the ro mount.
+      - ../adolf/openclaw.json:/home/node/.openclaw/openclaw.json:ro
     extra_hosts:
       - "host.docker.internal:host-gateway"
       # mtx.alogins.net's public A record can't hairpin-NAT back through the