Verify download, validate extract, align artisan with official docs

Lessons from the community upgrade gist and the official self-managed upgrade
docs:

- Verify the downloaded zip against the release .sha256 (when sha256sum is
  available) and validate the extracted tree (artisan, bootstrap, vendor, the
  compiled frontend bundle) before the live swap, so a truncated or corrupt
  download cannot replace a working install.
- Exclude storage/ from extraction since the live storage is carried over.
- Match the official upgrade command sequence: migrate --seed, cache:clear,
  view:clear, firefly-iii:upgrade-database, firefly-iii:laravel-passport-keys.
  Adds the previously missing view:clear and switches from the generic
  passport:install to Firefly's firefly-iii:laravel-passport-keys. Keeps
  --force and the oauth migration reconcile.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index c1c103b..2c745ae 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -29,6 +29,17 @@ Debian. See README.md for usage; this file is the non-obvious context.
   on the v2 error and login pages. Graphs breaking = missing `public/v1/js`
   bundles (see the zip point above), a different cause.
 
+- **Upgrade artisan sequence follows the official self-managed docs**:
+  `migrate --seed`, `cache:clear`, `view:clear`, `firefly-iii:upgrade-database`,
+  `firefly-iii:laravel-passport-keys`. Use `firefly-iii:laravel-passport-keys`,
+  NOT `passport:install`. We add `--force` (non-interactive) and the oauth
+  reconcile before migrate. Docs also confirm composer create-project is no
+  longer recommended.
+
+- **Release `.sha256` format** is `<hash> *FireflyIII-<tag>.zip` (BSD-style,
+  space then `*`); `cut -d' ' -f1` gets the hash. The script verifies it when
+  `sha256sum` is available, and validates the extracted tree before swapping.
+
 ## Conventions
 
 - Config via env vars (`WORKDIR`, `INSTANCE`, `BACKUPDIR`), matching the