docs: update all docs for container, cprofile, and config split

PROJECT.md

@@ -22,7 +22,17 @@ Client -------> s5p -------> Hop 1 -------> Hop 2 -------> Target
 - **server.py** -- asyncio SOCKS5 server, chain builder, bidirectional relay
 - **proto.py** -- protocol handshake implementations (SOCKS5, SOCKS4/4a, HTTP CONNECT)
 - **config.py** -- YAML config loading, proxy URL parsing
-- **cli.py** -- argparse CLI, logging setup
+- **cli.py** -- argparse CLI, logging setup, cProfile support
+
+## Deployment
+
+| Method | Command |
+|--------|---------|
+| Local venv | `pip install -e .` then `s5p -c config/s5p.yaml` |
+| Container | `make build && make up` (Alpine, ~59MB) |
+
+Container mounts `./src` and `./config/s5p.yaml` read-only at runtime.
+No application code is baked into the image.
 
 ## Dependencies
 
@@ -38,3 +48,5 @@ All other functionality uses Python stdlib (`asyncio`, `socket`, `struct`).
 - **asyncio** -- single-threaded event loop, efficient for I/O-bound proxying
 - **Domain passthrough** -- never resolve DNS locally to prevent leaks
 - **Tor as a hop** -- no special Tor handling; it's just `socks5://127.0.0.1:9050`
+- **Graceful shutdown** -- SIGTERM/SIGINT handled in the event loop for clean container stops
+- **Config split** -- tracked example template, gitignored live config with real addresses