docs: rename docs/ -> serverAppConfigs-docs/ per system-wide PROJECTNAME-docs convention

All in-repo path references (AGENTS.md, README, old scripts, report artifacts,
test code paths) rewritten in the same commit; focused-test map extended for
.gitignore, old/scripts/*, dankclaw/comfyui/*, and report/* per this repo's
own convention ('add one before committing'). Obsidian wikilinks are
title-based and unaffected.

serverAppConfigs-docs/Architecture/Network Architecture.md

@@ -0,0 +1,63 @@
+# Network Architecture
+
+One Caddy fronts both hosts. It runs as a container on Dankclaw (192.168.0.143) and terminates TLS for every service on the LAN. Pi-hole on Dankclaw answers the service names for LAN clients; Porkbun answers them for the WAN. The G36 router firewall governs external access. SearXNG outbound traffic exits through the Gluetun VPN container.
+
+## Topology
+
+```mermaid
+graph TB
+    subgraph WAN["G36 router 192.168.0.1"]
+        EXT[Internet]
+    end
+    EXT -->|port forwards| C
+    subgraph Dankclaw[192.168.0.143]
+        C[Caddy :80 :443]
+        D[Pi-hole :53]
+        C -->|comfyui:8188| F[ComfyUI]
+        C -->|192.168.0.143:3000| G[Gitea quadlet]
+        C -->|192.168.0.143:8081| SE[SearXNG quadlet]
+        C -->|192.168.0.143:3005| O[OpenWebUI quadlet]
+        SE -->|network_mode service| GL[Gluetun VPN]
+        GL -->|tunnel| EXT
+    end
+    subgraph Dankserver[192.168.0.235]
+        C -->|192.168.0.235:8085| R[RomM]
+        C -->|192.168.0.235:3923| P[Copyparty]
+        C -->|192.168.0.235:8083| W[Calibre-Web]
+        C -->|192.168.0.235:32400| PL[Plex host service]
+    end
+    CLIENT[LAN clients] -->|DHCP DNS| D
+```
+
+Dankserver runs no proxy of its own. Its services expose published LAN ports, and the Dankclaw Caddy routes the names to those ports.
+
+## Hostnames
+
+| Scope | Convention | Resolved by |
+|-------|------------|-------------|
+| LAN | `romm.franksdank.cloud` → 192.168.0.143 | Pi-hole (`addn-hosts`) |
+| WAN | `romm.franksdank.cloud` → 71.227.227.172 | Porkbun A record |
+
+Users type a name and nothing else. Caddy maps the name to the upstream. The split between the two resolvers removes the need for router NAT loopback. See [[LAN-DNS]] for the flow and the router hand-off.
+
+## TLS
+
+Caddy holds one Let's Encrypt certificate per vhost, issued and renewed through the DNS-01 challenge via the Porkbun module. No inbound port 80/443 is required. Details in [[Caddy]].
+
+## Gluetun Path (SearXNG only)
+
+SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetun`). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in [[Gluetun]].
+
+## Access Policy
+
+- The **G36 router firewall** governs what the WAN can reach. Port forwards are manual router steps; the repo tracks no router state.
+- Caddy adds HTTP basic auth on the homepage and on sensitive services.
+- LAN subnet: `192.168.0.0/24`.
+
+## See Also
+
+- [[LAN-DNS]] — name resolution, Pi-hole, router hand-off
+- [[Caddy]] — vhost map, TLS, basic auth
+- [[Dankserver Stack]], [[Dankclaw Stack]]
+- [[Gluetun]]
+- Knowledge base: [[Gluetun]], [[SearXNG]]