docs: rename docs/ -> serverAppConfigs-docs/ per system-wide PROJECTNAME-docs convention

All in-repo path references (AGENTS.md, README, old scripts, report artifacts,
test code paths) rewritten in the same commit; focused-test map extended for
.gitignore, old/scripts/*, dankclaw/comfyui/*, and report/* per this repo's
own convention ('add one before committing'). Obsidian wikilinks are
title-based and unaffected.

serverAppConfigs-docs/Architecture/Storage Policy.md

@@ -0,0 +1,40 @@
+# Storage Policy
+
+All persistent data uses **bind mounts**: a host directory mapped directly into the container. No named volumes. This matches the preference of this repo and the existing Gitea stack on Dankclaw.
+
+## Why Bind Mounts
+
+- The exact host location of every byte is visible and controllable.
+- Backups are a simple `tar` of known host directories.
+- The data survives container recreation and `podman-compose down`.
+- Ownership is explicit: everything runs as UID 1000 (`dank`) so host tools can read it.
+
+## Conventions
+
+| Stack | Host root |
+|-------|-----------|
+| Dankserver | `/opt/<service>/...` |
+| Dankclaw | `/opt/<service>/...` (Gitea keeps `/opt/gitea/data/...`) |
+
+## Ownership
+
+Containers run as `PUID=1000` / `PGID=1000`. Host directories must be owned by `dank`:
+
+```bash
+sudo chown -R 1000:1000 /opt/<service>
+```
+
+## Secrets
+
+Secrets never live in bind-mounted configs that get committed. They are:
+
+1. Set in `.env` files on the host (git-ignored, `.env.example` committed as template), or
+2. Injected as environment variables from the deploy script.
+
+The live Gitea database password exists only in `.env` on Dankclaw. A test enforces that it never appears in this repo.
+
+## See Also
+
+- [[Deployment Flow]]
+- [[Gitea]] — the existing bind-mount stack being migrated
+- [[Backblaze Integration]] — future backup target for these mounts