chore(guides): update guides

apps/docs/content/guides/backup.mdx

@@ -3,11 +3,6 @@ title: "Backup on Zerops"
 description: "Zerops auto-backs up databases and storage daily (00:00-01:00 UTC) with X25519 encryption; backups are retained for 7 days minimum after service/project deletion."
 ---
 
-
-## Keywords
-backup, restore, snapshot, daily backup, cron backup, encryption, retention, backup schedule
-
-## TL;DR
 Zerops auto-backs up databases and storage daily (00:00-01:00 UTC) with X25519 encryption; backups are retained for 7 days minimum after service/project deletion.
 
 ## Supported Services
@@ -59,8 +54,3 @@ End-to-end with X25519 per-project keys. Decrypted only on download.
 1. **Object Storage has no Zerops backup**: Use S3 lifecycle policies or external backup
 2. **Valkey/KeyDB not backed up**: In-memory data — use persistence or application-level backup
 3. **Backup storage is shared**: All services in a project share the backup quota
-
-## See Also
-- zerops://themes/core — platform infrastructure
-- zerops://themes/services — database service cards
-- zerops://guides/scaling

apps/docs/content/guides/build-cache.mdx

@@ -3,11 +3,6 @@ title: "Build Cache"
 description: "Zerops uses a two-layer build cache: base layer (OS + prepareCommands) and build layer (buildCommands output). The `cache:` attribute in zerops.yml controls which files persist between builds. Changing `build.os`, `build.base`, `build.prepareCommands`, or `build.cache` invalidates both layers (cascade)."
 ---
 
-
-## Keywords
-build cache, cache, invalidation, prepareCommands, buildCommands, base layer, build layer, node_modules, vendor, cache paths, cache true, cache false, build speed, build optimization, two-layer cache, cascade invalidation
-
-## TL;DR
 Zerops uses a two-layer build cache: base layer (OS + prepareCommands) and build layer (buildCommands output). The `cache:` attribute in zerops.yml controls which files persist between builds. Changing `build.os`, `build.base`, `build.prepareCommands`, or `build.cache` invalidates both layers (cascade).
 
 ---
@@ -97,7 +92,3 @@ CPU 1-5 cores, RAM 8 GB fixed, Disk 1-100 GB, Timeout 60 min. User `zerops` with
 2. **`cache: false` is misleading**: Only clears `/build/source` cache. Globally installed packages (Go modules, pip packages) persist in the base layer
 3. **No-clobber restore**: If source repo contains a file also in cache, **source wins** -- the cached version is silently skipped (logged but does not fail)
 4. **Lock file caching**: Cache lock files (`package-lock.json`, `composer.lock`) alongside dependency directories for consistent installs
-
-## See Also
-- zerops://themes/core -- zerops.yml schema and cache attribute syntax
-- zerops://guides/deployment-lifecycle -- full build and deploy pipeline sequence

apps/docs/content/guides/cdn.mdx

@@ -3,11 +3,6 @@ title: "CDN on Zerops"
 description: "Zerops CDN has 6 global regions with a **fixed 30-day cache TTL** (HTTP Cache-Control headers are ignored by CDN but still affect browsers). Built on Nginx + Cloudflare geo-steering."
 ---
 
-
-## Keywords
-cdn, cache, edge, content delivery, static assets, object storage cdn, geo-steering, purge, cache invalidation
-
-## TL;DR
 Zerops CDN has 6 global regions with a **fixed 30-day cache TTL** (HTTP Cache-Control headers are ignored by CDN but still affect browsers). Built on Nginx + Cloudflare geo-steering.
 
 ## Regions
@@ -63,7 +58,3 @@ zsc cdn purge /style.css$     # Purge exact file
 1. **30-day fixed TTL**: Cannot be changed — `Cache-Control: max-age=3600` has no effect on CDN
 2. **No wildcard domains on static CDN**: `*.domain.com` is not supported
 3. **Purge wildcards at end only**: `/images/*.jpg` is invalid — use `/images/*`
-
-## See Also
-- zerops://themes/services — Object Storage service card
-- zerops://guides/public-access

apps/docs/content/guides/choose-cache.mdx

@@ -3,11 +3,6 @@ title: "Choosing a Cache on Zerops"
 description: "**Use Valkey.** KeyDB development has stalled and is effectively deprecated on Zerops."
 ---
 
-
-## Keywords
-cache, redis, valkey, keydb, in-memory, session, key-value, choose cache, which cache
-
-## TL;DR
 **Use Valkey.** KeyDB development has stalled and is effectively deprecated on Zerops.
 
 ## Decision Matrix
@@ -35,7 +30,3 @@ cache, redis, valkey, keydb, in-memory, session, key-value, choose cache, which
 1. **HA replication is async**: Brief data loss possible during master failover
 2. **Port forwarding is Zerops-specific**: Replicas forward 6379/6380 to master — this is not standard Redis/Valkey behavior
 3. **Read replicas use different ports**: 7000/7001 for direct replica reads
-
-## See Also
-- zerops://themes/services — Valkey, KeyDB service cards and wiring
-- zerops://decisions/choose-database

apps/docs/content/guides/choose-database.mdx

@@ -3,11 +3,6 @@ title: "Choosing a Database on Zerops"
 description: "**Use PostgreSQL** for everything unless you have a specific reason not to. It's the best-supported database on Zerops with full HA, read replicas, and pgBouncer."
 ---
 
-
-## Keywords
-database, postgresql, mariadb, clickhouse, sql, relational, columnar, analytics, postgres, mysql, choose database, which database
-
-## TL;DR
 **Use PostgreSQL** for everything unless you have a specific reason not to. It's the best-supported database on Zerops with full HA, read replicas, and pgBouncer.
 
 ## Decision Matrix
@@ -43,7 +38,3 @@ database, postgresql, mariadb, clickhouse, sql, relational, columnar, analytics,
 1. **HA mode is immutable**: Cannot switch HA/NON_HA after creation — delete and recreate
 2. **No internal TLS**: Use `http://hostname:port` internally — VPN provides encryption
 3. **PostgreSQL URI scheme**: Some libraries need `postgres://` not `postgresql://` — create a custom env var
-
-## See Also
-- zerops://themes/services — PostgreSQL, MariaDB, ClickHouse service cards and wiring
-- zerops://decisions/choose-cache

apps/docs/content/guides/choose-queue.mdx

@@ -3,11 +3,6 @@ title: "Choosing a Message Queue on Zerops"
 description: "**Use NATS** for most cases (simple, fast, JetStream persistence). Use **Kafka** only for enterprise event streaming with guaranteed ordering and unlimited retention."
 ---
 
-
-## Keywords
-queue, message queue, kafka, nats, event, stream, pub-sub, broker, choose queue, which queue, messaging
-
-## TL;DR
 **Use NATS** for most cases (simple, fast, JetStream persistence). Use **Kafka** only for enterprise event streaming with guaranteed ordering and unlimited retention.
 
 ## Decision Matrix
@@ -45,7 +40,3 @@ queue, message queue, kafka, nats, event, stream, pub-sub, broker, choose queue,
 2. **Kafka single-node has no replication**: 1 broker = 3 partitions but zero redundancy
 3. **NATS JetStream HA sync interval**: 1-minute sync across nodes — brief data lag possible
 4. **Kafka SASL only**: No anonymous connections — always use the generated credentials
-
-## See Also
-- zerops://themes/services — NATS, Kafka service cards and wiring
-- zerops://decisions/choose-database

apps/docs/content/guides/choose-runtime-base.mdx

@@ -3,11 +3,6 @@ title: "Choosing a Runtime Base on Zerops"
 description: "**Use Alpine** as the default base for all services. Use Ubuntu only when you need system packages not available in Alpine. Use Docker only for pre-built images."
 ---
 
-
-## Keywords
-alpine, ubuntu, docker, container, base image, linux, runtime base, os, choose base, which container
-
-## TL;DR
 **Use Alpine** as the default base for all services. Use Ubuntu only when you need system packages not available in Alpine. Use Docker only for pre-built images.
 
 ## Decision Matrix
@@ -48,7 +43,3 @@ alpine, ubuntu, docker, container, base image, linux, runtime base, os, choose b
 2. **Docker is VM-based**: Vertical scaling restarts the VM — expect brief downtime
 3. **Docker `:latest` is cached**: Zerops won't re-pull — always use specific tags like `myapp:1.2.3`
 4. **Docker requires host networking**: Without `--network=host`, the container can't receive traffic
-
-## See Also
-- `zerops://runtimes/{name}` — per-runtime guides (e.g. zerops://runtimes/alpine, zerops://runtimes/docker)
-- zerops://themes/core — build environment rules

apps/docs/content/guides/choose-search.mdx

@@ -3,11 +3,6 @@ title: "Choosing a Search Engine on Zerops"
 description: "**Use Meilisearch** for simple full-text search. Use **Elasticsearch** for advanced queries or HA requirements. Use **Qdrant** for vector/AI search."
 ---
 
-
-## Keywords
-search, elasticsearch, meilisearch, typesense, qdrant, vector, full-text, choose search, which search engine
-
-## TL;DR
 **Use Meilisearch** for simple full-text search. Use **Elasticsearch** for advanced queries or HA requirements. Use **Qdrant** for vector/AI search.
 
 ## Decision Matrix
@@ -55,6 +50,3 @@ search, elasticsearch, meilisearch, typesense, qdrant, vector, full-text, choose
 2. **Qdrant is internal-only**: Cannot be exposed publicly — access via your runtime service
 3. **Typesense API key is immutable**: Cannot change `apiKey` after service creation
 4. **Elasticsearch plugins require restart**: Changing `PLUGINS` env var needs service restart
-
-## See Also
-- zerops://themes/services — Meilisearch, Elasticsearch, Typesense, Qdrant service cards and wiring

apps/docs/content/guides/ci-cd.mdx

@@ -3,11 +3,6 @@ title: "CI/CD on Zerops"
 description: "Zerops supports GitHub/GitLab webhook triggers (new tag or push to branch) and GitHub Actions / GitLab CI via `zcli push` with an access token."
 ---
 
-
-## Keywords
-ci cd, github, gitlab, github actions, gitlab ci, webhook, automatic deploy, trigger, pipeline, continuous deployment, zcli push, jenkins, circleci, generic ci
-
-## TL;DR
 Zerops supports GitHub/GitLab webhook triggers (new tag or push to branch) and GitHub Actions / GitLab CI via `zcli push` with an access token.
 
 ## GitHub Integration (Webhook)
@@ -20,7 +15,6 @@ Zerops supports GitHub/GitLab webhook triggers (new tag or push to branch) and G
 
 ### GitHub Actions
 ```yaml
-# .github/workflows/deploy.yaml
 name: Deploy
 on: push
 jobs:
@@ -59,7 +53,6 @@ Service detail → Build, Deploy, Run → Stop automatic build trigger.
 ## GitLab CI
 
 ```yaml
-# .gitlab-ci.yml
 deploy:
   stage: deploy
   image: ubuntu:latest
@@ -89,8 +82,3 @@ Any CI system with shell access can deploy via `zcli push`:
 | `--workspace-state` | `all` (default), `clean` (git clean), `staged` (staged only) |
 | `--no-git` | Deploy without git context |
 | `--deploy-git-folder` | Include `.git/` directory in deploy |
-
-## See Also
-- zerops://themes/core -- zerops.yml schema reference
-- zerops://guides/deployment-lifecycle -- build and deploy pipeline
-- zerops://themes/core -- platform infrastructure

apps/docs/content/guides/cloudflare.mdx

@@ -3,11 +3,6 @@ title: "Cloudflare Integration with Zerops"
 description: "Always use **Full (strict)** SSL mode in Cloudflare — \"Flexible\" causes redirect loops. Shared IPv4 with Cloudflare proxy is not recommended."
 ---
 
-
-## Keywords
-cloudflare, dns, ssl, tls, proxy, cname, aaaa, redirect loop, full strict, acme, wildcard domain, cloudflare ssl
-
-## TL;DR
 Always use **Full (strict)** SSL mode in Cloudflare — "Flexible" causes redirect loops. Shared IPv4 with Cloudflare proxy is not recommended.
 
 ## DNS Configuration
@@ -70,8 +65,3 @@ Internal service-to-service communication must always use `http://` — never `h
 3. **ACME challenge needs WAF exception**: Without it, Cloudflare blocks Let's Encrypt validation
 4. **Wildcard SSL on Cloudflare Free**: Free plan doesn't proxy wildcard subdomains — use DNS-only or upgrade
 5. **Subdomain on undeployed service**: `zerops_subdomain enable` returns "Service stack is not http or https" on READY_TO_DEPLOY services — deploy code first or use `enableSubdomainAccess` in import YAML
-
-## See Also
-- zerops://guides/public-access
-- zerops://guides/firewall
-- zerops://guides/networking

apps/docs/content/guides/deployment-lifecycle.mdx

@@ -3,11 +3,6 @@ title: "Deployment Lifecycle"
 description: "Zerops build & deploy pipeline: temporary build container runs prepareCommands + buildCommands, uploads artifact via deployFiles, then deploys to runtime containers with optional readiness checks. Default is zero-downtime rolling deployment. Build has a 60-minute timeout. The pipeline emits events trackable via `zerops_events`."
 ---
 
-
-## Keywords
-deploy, build, pipeline, lifecycle, build container, deploy process, rolling deployment, zero downtime, readiness check, health check, temporaryShutdown, build timeout, artifact, deploy files, prepareCommands, buildCommands, init commands, start command, container replacement, application version, build cancel, runtime prepare
-
-## TL;DR
 Zerops build & deploy pipeline: temporary build container runs prepareCommands + buildCommands, uploads artifact via deployFiles, then deploys to runtime containers with optional readiness checks. Default is zero-downtime rolling deployment. Build has a 60-minute timeout. The pipeline emits events trackable via `zerops_events`.
 
 ---
@@ -174,9 +169,3 @@ When using SSHFS (`zerops_mount`) for dev workflows, deploy replaces the contain
 **Two kinds of "mount" (disambiguation):**
 - `zerops_mount` -- SSHFS tool, mounts service `/var/www` locally for development. This is a dev workflow tool.
 - Shared storage mount -- platform feature, attaches a shared-storage volume at `/mnt/{hostname}` via `mount:` in import.yml + zerops.yml `run.mount`. These are completely unrelated features.
-
-## See Also
-- zerops://themes/core -- zerops.yml schema and platform rules
-- zerops://guides/build-cache -- two-layer cache architecture and invalidation
-- zerops://guides/ci-cd -- triggering pipelines from GitHub/GitLab
-- zerops://guides/logging -- build and runtime log access

apps/docs/content/guides/environment-variables.mdx

@@ -3,11 +3,6 @@ title: "Environment Variables"
 description: "Zerops manages environment variables at two scopes (project and service) with strict build/runtime isolation. Variables are set via zerops.yml, import.yml, or GUI. Cross-service references use `${hostname_varname}` syntax. Project vars auto-inherit into all services. Secret vars are write-only after creation. Changes require service restart."
 ---
 
-
-## Keywords
-environment variables, env, envVariables, envSecrets, dotEnvSecrets, envReplace, secrets, project variables, service variables, cross-service reference, variable precedence, build runtime isolation, RUNTIME_ prefix, BUILD_ prefix, variable shadowing, envIsolation, restart, placeholder replacement
-
-## TL;DR
 Zerops manages environment variables at two scopes (project and service) with strict build/runtime isolation. Variables are set via zerops.yml, import.yml, or GUI. Cross-service references use `${hostname_varname}` syntax. Project vars auto-inherit into all services. Secret vars are write-only after creation. Changes require service restart.
 
 ---
@@ -96,11 +91,9 @@ Project variables are **automatically available** in every service (build and ru
 
 **DO NOT** re-reference project variables in service envVariables:
 ```yaml
-# WRONG -- creates shadow, may cause circular reference
 envVariables:
   PROJECT_NAME: ${PROJECT_NAME}
 
-# CORRECT -- just use it in your app code, it's already there
 ```
 
 To **override** a project variable for one service, define a service-level variable with the same key:
@@ -172,8 +165,3 @@ Zerops auto-generates variables per service (e.g., `hostname`, `PATH`, DB connec
 - **DO NOT** expect `envReplace` to recurse subdirectories -- it does not
 - **DO NOT** rely on reading secret values back -- they are write-only after creation
 - **DO NOT** create both secret and basic vars with same key -- basic silently wins
-
-## See Also
-- zerops://themes/core -- schema, build/deploy semantics, variable basics
-- zerops://themes/services -- cross-service wiring patterns using env vars
-- zerops://guides/production-checklist -- pre-launch variable audit

apps/docs/content/guides/firewall.mdx

@@ -3,11 +3,6 @@ title: "Firewall on Zerops"
 description: "Zerops uses nftables with restricted TCP ports 1-1024 (only 22, 53, 80, 123, 443, 587 allowed); UDP and ports 1025-65535 are unrestricted."
 ---
 
-
-## Keywords
-firewall, ports, nftables, tcp, udp, blocked ports, smtp port, port restriction, allowed ports
-
-## TL;DR
 Zerops uses nftables with restricted TCP ports 1-1024 (only 22, 53, 80, 123, 443, 587 allowed); UDP and ports 1025-65535 are unrestricted.
 
 ## TCP Ports 1-1024 (Restricted)
@@ -43,8 +38,3 @@ Contact `support@zerops.io` with Project ID + Organization ID to request changes
 1. **Port 25 is permanently blocked**: Use port 587 with STARTTLS for email sending
 2. **Port 465 is blocked**: Legacy SMTPS — use 587 instead
 3. **Cannot self-service unblock**: Must contact Zerops support for port exceptions
-
-## See Also
-- zerops://guides/public-access
-- zerops://guides/smtp
-- zerops://guides/networking

apps/docs/content/guides/local-development.mdx

@@ -3,11 +3,6 @@ title: "Local Development with Zerops"
 description: "Develop locally with hot reload while connecting to Zerops managed services (DB, cache, storage) via VPN. ZCP generates `.env` with real credentials. Deploy to Zerops with `zerops_deploy` which uses `zcli push` under the hood."
 ---
 
-
-## Keywords
-local development, local dev, zcli push, vpn, env file, dotenv, hot reload, dev server, local mode, zcli vpn, local deploy, environment variables local
-
-## TL;DR
 Develop locally with hot reload while connecting to Zerops managed services (DB, cache, storage) via VPN. ZCP generates `.env` with real credentials. Deploy to Zerops with `zerops_deploy` which uses `zcli push` under the hood.
 
 ---
@@ -47,7 +42,6 @@ zcli vpn up <project-id>
 ### 2. Load credentials
 ZCP generates `.env` from `zerops_discover`:
 ```
-# db (postgresql@16)
 db_host=db
 db_port=5432
 db_password=<actual-password>

apps/docs/content/guides/logging.mdx

@@ -3,11 +3,6 @@ title: "Logging on Zerops"
 description: "Zerops captures stdout/stderr as logs; use syslog output format for severity filtering. Supports forwarding to Better Stack, Papertrail, or self-hosted ELK via syslog."
 ---
 
-
-## Keywords
-logging, logs, syslog, build logs, runtime logs, service log, log access, log severity, log forwarding, better stack, papertrail, elk, logstash, syslog-ng, external logging, log aggregation
-
-## TL;DR
 Zerops captures stdout/stderr as logs; use syslog output format for severity filtering. Supports forwarding to Better Stack, Papertrail, or self-hosted ELK via syslog.
 
 ## Log Types
@@ -66,6 +61,3 @@ Certificate paths:
 3. **Source name must be `s_src`**: Using `s_sys` (common default) will not capture Zerops logs
 4. **UDP for Logstash**: Zerops forwards logs via UDP syslog — ensure Logstash listens on UDP
 5. **Custom certs path**: Place custom CA certs in `/etc/syslog-ng/user.crt`
-
-## See Also
-- zerops://guides/metrics

apps/docs/content/guides/metrics.mdx

@@ -3,11 +3,6 @@ title: "Metrics on Zerops"
 description: "Zerops supports ELK (APM + logs) and Prometheus/Grafana stacks; expose `/metrics` endpoint and set `ZEROPS_PROMETHEUS_PORT` for auto-scraping."
 ---
 
-
-## Keywords
-metrics, monitoring, prometheus, grafana, elk, apm, elastic apm, observability, custom metrics, dashboard
-
-## TL;DR
 Zerops supports ELK (APM + logs) and Prometheus/Grafana stacks; expose `/metrics` endpoint and set `ZEROPS_PROMETHEUS_PORT` for auto-scraping.
 
 ## Deployment Modes
@@ -55,7 +50,3 @@ envVariables:
 1. **`ZEROPS_PROMETHEUS_PORT` is required**: Without it, Prometheus won't discover your custom metrics endpoint
 2. **APM server must be public**: Use Zerops subdomain to expose apmserver for trace collection
 3. **Cross-project needs forwarder**: Use `prometheuslight` service in source project to forward to global Prometheus
-
-## See Also
-- zerops://guides/logging
-- zerops://themes/services — Elasticsearch, PostgreSQL service cards