docs: rename frank-default-large/small/sightsound to frank-large/small/npu across vault

Mechanical identity rename across the knowledge base, AGENTS.md, README, the
hermes config example, and homepage services.json. No behavior change; served
aliases on the LLM endpoints change with the deploy of commit 69f87c8.

serverAppConfigs-docs/Dankserver/Copyparty.md

@@ -2,14 +2,16 @@
 
 Copyparty is a lightweight file server and media streamer that runs as a single Python binary. It handles large payloads, media streaming, resumable uploads, directory browsing, and WebDAV from one process.
 
-**Host:** Dankserver — **Hostname:** `files.dankserver.local` — **Docs:** https://github.com/9001/copyparty
+**Host:** Dankserver — **Access:** `files.franksdank.cloud` guarded by the
+Anubis → Authentik chain ([[Caddy]] routes it post-auth to
+`192.168.0.235:3923`); the published port itself stays unauthenticated on the
+LAN — **Docs:** https://github.com/9001/copyparty
 
 ## Facts
 
 | Item | Value |
 |------|-------|
-| Latest version | v1.20.21 (2026-08) |
-| Image | `ghcr.io/9001/copyparty-ac:latest` (ac = full edition; the bare `copyparty:latest` tag does not exist — ghcr answers 403 on the token request for nonexistent repos) |
+| Running image | `ghcr.io/9001/copyparty-ac:latest` (ac = full edition; the bare `copyparty:latest` tag does not exist — ghcr answers 403 on the token request for nonexistent repos). Version at research time (2026-08): v1.20.21 |
 | Port | 3923 (host) → 3923 (container) |
 | Volume | bind mount the shared root directory |
 | Auth | Per-directory `.cpy` config files, HTTP basic auth, `dirkeys`, `filekeys` |
@@ -72,13 +74,12 @@ The `iv` edition is no longer available for arm32/armv6. Use `dj` for maximum co
 
 ## Volumes
 
-Live deployment: the whole LUKS array is served at URL `/w` (the ac edition
-takes its volume roots from argv plus `chdir: /w` in `/z/initcfg`, not from a
-`/data` convention). Access is **read-only since 2026-08-31** (`-v /w::r:ra,dank`
-— see [[#Command-line interface (ac edition)]] above). The compose bind mount is
-`/mnt/entropy:/w` (host path → container path). Note the bind itself is still
-rw on disk — copyparty enforces read-only at the application layer, so local
-services (Jellyfin, Calibre) keep writing into the array directly.
+Live deployment: the whole LUKS array is served at URL `/w` via
+`Volume=/mnt/entropy:/w:ro` in the quadlet unit ([[Entropy Volume]]) —
+read-only **at the mount level**, so no containerized consumer can write into
+the array through this path regardless of account permissions. The ac edition
+takes its volume roots from argv (`-v /w::r:ra,dank`), not from a `/data`
+convention; see [[#Command-line interface (ac edition)]] above.
 
 ## Docker Compose (reference — retired 2026-09-01; live deployment is the quadlet unit below)
 
@@ -146,13 +147,15 @@ Upgrade to v1.20.19+ to cover all known CVEs. The dirkey fix (v1.20.17) matters
 - **Large transfers:** Disable TLS inside the app and let Caddy terminate TLS. This avoids double encryption overhead.
 - **Dedicated share directory:** Do not give Copyparty the whole disk. Mount only the intended share path.
 - **Whole-disk share (live choice):** this deployment *does* serve the whole
-  91 T array from `/w`. Since 2026-08-31 the volume is application-level
-  read-only for every account, so no remote write path exists. But note:
+  ~91 T array from `/w`. The volume is mounted `:ro` in the unit AND the
+  permission flags grant anonymous only `r`, so no remote write path exists at
+  all now. But note:
   **LAN-direct `:3923` is unauthenticated browse/download** (anonymous holds
   `r`) — Caddy + Anubis + authentik guard only `files.franksdank.cloud`, not
   the published port. Tighten to `-v /w::r,dank` if anonymous LAN reads become
   unacceptable. (Before 2026-08-31, `-v /w::A` made the array world-writable
-  on the LAN — see [[#Command-line interface (ac edition)]].)
+  on the LAN — see [[#Command-line interface (ac edition)]] — and the mount
+  was rw.)
 - **Upload tokens scoped per folder:** Prevents accidental global write access.
 - **CSP nonces (v1.20.17+):** Security hardening for JavaScript execution. May break third-party JS plugins (`--js-browser` / `--html-head`).
 - **Custom thumbnail extractors (v1.20.19+):** New `thumbex` framework. Requires configuration in `initcfg`.