docs(fleet): live-probe corrections across dankclaw, caddy, gitea, searxng, vpn docs

Live read-only probes on Dankclaw (BatchMode ssh, 2026-10-19):

- system/dankclaw.md: full 32-container census added (authentik IdP,
  prometheus/grafana/loki/alloy/alertmanager monitoring, pihole, ntfy,
  seerr, hermes stack, anubis, frank-tts :7772 all undocumented);
  dragoon pool corrected 401,408 @ ctx 200,704 (was conflated);
  zealot corrected to PrismML build 10777, Ternary-Bonsai-2-9B
  PQ2_0-MTP, 2x262,144 over one 524,288 pool, f16 K+V (doc claimed
  build 10754, 27B, 2x200,704)
- caddy/index.md: v2.11.7 (in-container ), deduped
  caddyfile listing
- gitea: version 1.27.3 probed via API; systemd-gitea network + rootless
  100999 mapping confirmed live (gitea-server attaches systemd-gitea;
  dank subuid 100000:65536); index See-Also de-duplicated
- searxng-tuning.md: live instance section (ghcr image, valkey:9-alpine,
  marreta netns-sharing explains duplicate port maps); POLICY DRIFT FLAG:
  tuned engine policy (google/bing disabled, verified 2026-08-16) is NOT
  live — /config now shows all 262 engines enabled; upstream settings.yml
  count corrected 388@master; limiter table already matched source
- vpn-routing.md: verify snippet fixed — gluetun image ships no curl;
  health server is 127.0.0.1:9999/health ('OK'), :8000 is the CONTROL
  server (404s on health paths); correct probes provided

Refs #29

omp-docs/system/dankclaw.md

@@ -11,15 +11,29 @@ tags:
 generated:
   by: chief-designer/agent
   at: 2026-08-26T00:00:00Z
-verified: 2026-10-18
+verified: 2026-10-19
 ---
 
 # Dankclaw
 
-Strix Halo mini-PC carrying the fleet's secondary models and most of the
-service stack (Gitea, Caddy, OpenWebUI, SearXNG). Two GPU-class devices: the
-Radeon 8060S iGPU with 119 GiB unified memory, and the RTX 3090 moved over
-from Dankserver in September 2026.
+Strix Halo mini-PC carrying the fleet's secondary models and the bulk of the
+service stack. Two GPU-class devices: the Radeon 8060S iGPU with 119 GiB
+unified memory, and the RTX 3090 moved over from Dankserver in September 2026.
+
+## Service Stack (live census, 32 containers, 2026-10-19)
+
+User-scope Podman Quadlet units (`~/.config/containers/systemd/`) unless
+noted. Full names; detail pages where they exist.
+
+| Group | Containers |
+|-------|-----------|
+| Inference (root systemd, not quadlet) | `frank-dragoon` (:7770), `frank-zealot` (:7771) |
+| TTS | `frank-tts` (:7772), `frank-tts-engine` (:8880) |
+| Git forge | `gitea-server` (:3000/:2222), `gitea-postgres` — see [/tools/gitea/](/tools/gitea/index.md) |
+| Web/search | `caddy` (:80/:443, Porkbun build), `searxng` (:8081/:8082 via `gluetun`), `searxng-valkey`, `marreta`, `marreta_browser`, `anubis` (bot shield), `chrome-devtools-protocol` (headless-shell) |
+| Identity | `authentik-server` (:9000), `authentik-worker`, `authentik-outpost`, `authentik-outpost-ldap` (:389/:636), `authentik-postgres` |
+| Monitoring | `prometheus` (:9090), `grafana` (:3002), `loki`, `alloy`, `alertmanager` (:9093), `node-exporter` — loopback-only ports |
+| Media/apps | `open-webui` (:3005), `comfyui` (:8188, ROCm `gfx1151`), `seerr` (:5055), `hermes`/`hermes-webui`/`hermes-dashboard` (:9119), `ntfy` (pubsub), `pihole` (:53 DNS, :8083 admin) |
 
 ## Connection Details
 
@@ -33,8 +47,8 @@ from Dankserver in September 2026.
 
 | Model ID | Unit | Endpoint | Engine / weights |
 |----------|------|----------|------------------|
-| `frank-dragoon` | `frank-dragoon.service` (root) | `:7770` | halogen-flash-server container — Quat3rnion NATIVE v2 abliterated Qwen3.8-Flash-Next, MTP spec decode, 2 slots over ONE 200,704-position pool, vision ON, **Strix Halo iGPU** (unified memory) |
-| `frank-zealot` | `frank-zealot.service` (root) | `:7771` | llama.cpp (PrismML fork, build 10754) — Ternary-Bonsai-2-27B PQ2_0 GGUF (qwen35 hybrid), 2×200,704 slots, q8_0 K+V, mmproj vision, **RTX 3090** |
+| `frank-dragoon` | `frank-dragoon.service` (root) | `:7770` (container `frank-dragoon-halogen`, 7770→8731) | halogen-flash-server container (`ghcr.io/peonist-ai/halogen-flash-server`, digest-pinned) — Quat3rnion NATIVE v2 abliterated Qwen3.8-Flash-Next, MTP spec decode, 2 slots over ONE **401,408**-position pool at ctx **200,704**, vision ON, **Strix Halo iGPU** (unified memory) |
+| `frank-zealot` | `frank-zealot.service` (root) | `:7771` | llama.cpp (PrismML fork, build 10777) — Ternary-Bonsai-**2-9B** PQ2_0-MTP GGUF (qwen35 hybrid), 2×262,144 slots over one 524,288 pool, **unquantized f16 K+V**, MTP off, mmproj Q8_0 vision, **RTX 3090** |
 
 Harness-side context windows (`agent/models.yml`): dragoon 155,648,
 zealot 200,704 per slot. The models.yml display labels "(dankclaw-gpu)" /