sync: update from private repo (a67c053)

docs/getting-started.md

@@ -73,6 +73,27 @@ scripts/server.sh stop
 > `--skip-python`. In environments where writing to the system Python requires permissions, run
 > `sudo bash scripts/prebake-python.sh` separately.
 
+### Updating an existing install (after `git pull`)
+
+To update a bare-metal install, run:
+
+```bash
+scripts/upgrade.sh            # git pull -> rebuild (deps + server + UI) -> restart
+```
+
+A plain `scripts/server.sh restart` rebuilds only the server, **not** the UI
+(`ui/dist` is gitignored and built separately) and never refreshes npm deps, so
+after a pull that changed dependencies or the frontend it can leave a stale UI
+bundle. `scripts/upgrade.sh` runs the full, correct sequence instead.
+
+It also handles the **network bind migration**: since 2026-06-10 the server
+binds `127.0.0.1` (loopback only) by default instead of `0.0.0.0`, for security
+(the agent API includes a Bash tool, so an auth-less instance on the LAN is
+effectively unauthenticated RCE). If you reach MAESTRO from another machine and
+suddenly get `ERR_CONNECTION_REFUSED` after updating, that is why — set `HOST`
+explicitly (e.g. `HOST=0.0.0.0` in `.env`) and enable auth in `config.yaml`
+first. The upgrade script detects this and offers to set it for you.
+
 ## 5. Launch with Docker
 
 ```bash