Enable Ente CLI persistence and update docs

POSTINSTALL.md

@@ -20,11 +20,29 @@ Supported variables:
 - `S3_SECRET_KEY`
 - `S3_PREFIX` (optional path prefix)
 
+## Required: DNS Subdomains
+
+Ente now serves supporting apps on dedicated hosts. Create DNS records (CNAME or A) for:
+
+- `accounts.<root-domain>`
+- `auth.<root-domain>`
+- `cast.<root-domain>`
+- `albums.<root-domain>`
+- `family.<root-domain>`
+
+For example, if you installed the app at `ente.due.ren`, create records for `accounts.due.ren`, `auth.due.ren`, etc., all pointing to `ente.due.ren`. After adding the DNS records, open the Cloudron dashboard → Ente app → Domains tab and add each hostname as an alias. DNS propagation must complete before the `/accounts` and `/auth` apps will accept sessions.
+
 ## Next Steps
 
 - Visit the app URL and create the first administrator account.
 - Configure the Ente mobile apps to use your custom server (`Settings → Advanced → Custom Server`).
 - Optional: set the environment variables `CLOUDRON_OIDC_IDENTIFIER`, `CLOUDRON_OIDC_CLIENT_ID`, and `CLOUDRON_OIDC_CLIENT_SECRET` to enable Cloudron SSO in the generated Museum config.
+- Administrative CLI tooling is available inside the container. Open a terminal and run:
+  ```bash
+  cloudron exec --app ente.due.ren -- sudo -u cloudron ente --help
+  cloudron exec --app ente.due.ren -- sudo -u cloudron ente admin --help
+  ```
+  The CLI stores its state at `/app/data/cli-data` (inside the container it is available at `/cli-data`). Consult the upstream CLI guide for per-command usage, including storage quota adjustments.
 
 ## Administration Helpers