hand the registry credentials to the nodes

A node that pulls an image authenticates as nobody unless the task carries
credentials, and the registry counts anonymous pulls per address, so the whole
estate shares one budget. Deployments and image updates now pass
--with-registry-auth, and --rotate-key writes the current credentials into every
service of a stack after the account token has been rotated, without touching
the images.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -21,11 +21,15 @@ docker-deploy
 
 Just deploys a docker swarm stack from a yaml compose file. It saves me some typing. It scans the file for the volume pathes and creates them if they do not exist yet. Instead of the two commands `mkdir -p /var/volumes/my-service` and `docker stack deploy --compose-file my-service.yaml my-service`, I have to type only `docker-deploy my-service`. Yes, I am lazy.
 
+The deployment runs with `--with-registry-auth`, so the registry credentials of the machine you deploy from travel to the nodes with every task. Run `docker login` there first: without credentials every node pulls anonymously, and the registry counts those pulls per address.
+
 docker-update
 -------------
 
 Script to update all or some images within declared in a yaml file. Use it to update the docker image of all or some services in your already deployed docker swarm stack.
 
+With `--rotate-key` it writes the registry credentials of the machine you run it on into every service of the stack and leaves the images untouched. A service carries the credentials of the moment it was deployed, and a node uses them when it pulls, so after the token of the registry account has been rotated every service needs them once.
+
 docker-build
 ------------