docs: surface telemetry controls for self-hosted deployments

[DivyamTalwar]

Summary

Self-hosted telemetry is enabled by default, but the repository's self-hosting docs did not surface the existing TELEMETRY=false opt-out clearly before first start. This PR adds telemetry pointers in the README and Docker guide, expands docs/telemetry.md with the current telemetry behavior and caveats, and tightens Docker first-run guidance so operators understand the required .env, model-provider choice, and development-only defaults before starting services.

Changes

• Add a self-hosting README note that links to the telemetry documentation and the repository-local Docker guide.
• Add a Docker Quick Start step to create the required .env file before first start, with the TELEMETRY=false opt-out shown before services start.
• Clarify .env.example so Docker users know Compose injects the container POSTGRES_URI, while direct/local runs can use the template value.
• Add a commented TELEMETRY=false entry to .env.example.
• Clarify the Docker guide's repository-clone path: ./start-dev.sh mounts the checked-in development morphik.toml, auth bypass is enabled there, and model-backed operations need a Docker-reachable provider.
• Document the OpenAI-template and Ollama-in-Compose model paths, including OPENAI_API_KEY, http://ollama:11434, and the extra qwen2.5vl:latest pull needed by the checked-in Ollama vision selections.
• Correct the Docker .env example to show environment-backed secrets and provider keys, while directing host, port, model, database, storage, and provider-selection settings to morphik.toml.
• Add Docker security notes for auth bypass, default bundled PostgreSQL credentials, the exposed host database port, and the current image startup-check constraint around bundled database defaults.
• Clarify local telemetry file location, per-process first_start heartbeat behavior, restart requirement for disabling telemetry, installation identifier durability, emitted identifiers/metadata, raw error-text behavior, upload/heartbeat/query endpoints, /logs local/proxy boundaries, upload truncation, local retention limits, and the difference between the opt-out environment variable and [telemetry] tuning keys.

Why this matters

Self-hosted operators should be able to find telemetry behavior and opt-out controls before starting services. Docker-first users should also see the first-run assumptions that materially affect privacy, auth, model configuration, and local-only safety.

Tests

Commands run:

• Content presence check — passed:

  rg -n 'Direct/local runs can set POSTGRES_URI|Docker Compose sets the container|registered_models|model = "openai_gpt4-1-mini"|model = "openai_embedding"|COMPOSE_PROFILES=ollama ./start-dev.sh --build|optional profiles for Ollama|qwen2\\.5vl:latest|rotated database users|image startup check|Non-local Deployment Checklist|JWT_SECRET_KEY` and `SESSION_SECRET_KEY|first successful heartbeat|retry with the `first_start` label|auth bypass is disabled and requests carry a real app scope|#self-hosting-morphik|#license|# TELEMETRY=false' README.md DOCKER.md docs/telemetry.md .env.example

• Stale/unsafe wording absence check — passed:

  if rg -n 'point Morphik at an external database before any non-local deployment|Disabling telemetry later stops future telemetry|Change the default `JWT_SECRET_KEY`$|default configuration works out of the box|Basic authentication|provider = "ollama"|model_name = "llama3\\.2"|base_url = "http://ollama:11434"|Download necessary AI models|default configuration.*Ollama|HOST=0\\.0\\.0\\.0|PORT=8000|Change if needed' DOCKER.md docs/telemetry.md; then exit 1; fi

• Markdown render check — passed:

  .venv/bin/markdown-it README.md >/tmp/readme-pr9.html && .venv/bin/markdown-it DOCKER.md >/tmp/docker-pr9.html && .venv/bin/markdown-it docs/telemetry.md >/tmp/telemetry-pr9.html

• Markdown code-fence check for TOML parsing and Bash syntax in docs/telemetry.md and DOCKER.md — passed.
• Required .env Docker Compose check from a no-.env state — passed. I verified that creating a temporary .env from .env.example lets docker compose config --quiet render successfully, and cleanup restored the no-.env state.
• Docker Compose opt-out wiring check — passed; with TELEMETRY=false appended to a temporary .env, docker compose config rendered TELEMETRY: "false" for both morphik and worker.
• git diff --check origin/main...HEAD — passed.

Not run:

• Hosted docs build was not run; this repository checkout does not include a root docs-site build config for docs/telemetry.md.
• End-to-end model-provider startup was not run; this PR documents existing configuration paths and does not change runtime model selection.

Risk

Risk level: low

Docs/template-comment-only change. The wording is based on existing Docker Compose, config, auth, and telemetry code paths and does not change runtime configuration, telemetry payloads, auth behavior, database credentials, or defaults.

Issue

No existing issue. This was discovered during repository analysis.

Notes for maintainers

I intentionally avoided changing TOML sample configs, auth defaults, Docker database credentials, or telemetry persistence behavior in this PR. Those would be runtime changes and should be reviewed separately.