docs(fleet): live-probe corrections across dankclaw, caddy, gitea, searxng, vpn docs

Live read-only probes on Dankclaw (BatchMode ssh, 2026-10-19):

- system/dankclaw.md: full 32-container census added (authentik IdP,
  prometheus/grafana/loki/alloy/alertmanager monitoring, pihole, ntfy,
  seerr, hermes stack, anubis, frank-tts :7772 all undocumented);
  dragoon pool corrected 401,408 @ ctx 200,704 (was conflated);
  zealot corrected to PrismML build 10777, Ternary-Bonsai-2-9B
  PQ2_0-MTP, 2x262,144 over one 524,288 pool, f16 K+V (doc claimed
  build 10754, 27B, 2x200,704)
- caddy/index.md: v2.11.7 (in-container ), deduped
  caddyfile listing
- gitea: version 1.27.3 probed via API; systemd-gitea network + rootless
  100999 mapping confirmed live (gitea-server attaches systemd-gitea;
  dank subuid 100000:65536); index See-Also de-duplicated
- searxng-tuning.md: live instance section (ghcr image, valkey:9-alpine,
  marreta netns-sharing explains duplicate port maps); POLICY DRIFT FLAG:
  tuned engine policy (google/bing disabled, verified 2026-08-16) is NOT
  live — /config now shows all 262 engines enabled; upstream settings.yml
  count corrected 388@master; limiter table already matched source
- vpn-routing.md: verify snippet fixed — gluetun image ships no curl;
  health server is 127.0.0.1:9999/health ('OK'), :8000 is the CONTROL
  server (404s on health paths); correct probes provided

Refs #29

omp-docs/agentic-web-research/vpn-routing.md

@@ -171,8 +171,14 @@ This pattern places the whole SearXNG process inside the tunnel namespace. The h
 4. Confirm that unrelated host traffic keeps the host IP.
 
 ```bash
-# From inside the tunnel with Gluetun
-docker exec gluetun curl -s ifconfig.me
+# Gluetun ships no curl; use its own endpoints or a throwaway container.
+podman exec gluetun sh -c 'test -e /sys/class/net/tun0 && echo tunnel-up'
+podman exec gluetun sh -c 'wget -qO- 127.0.0.1:9999/health'   # "OK" when up
+# NOTE: :9999 is Gluetun's HTTP health server (200 "OK" / 500); :8000 is the
+# CONTROL server (/v1/* API), which 404s on everything else. Do not health-
+# probe :8000. Egress-IP check needs a real binary — run a companion
+# container on gluetun's network: docker run --rm --net container:gluetun
+# curlimages/curl -s ifconfig.me
 ```
 
 ## Citations