docs: rename frank-default-large/small/sightsound to frank-large/small/npu across vault

Mechanical identity rename across the knowledge base, AGENTS.md, README, the
hermes config example, and homepage services.json. No behavior change; served
aliases on the LLM endpoints change with the deploy of commit 69f87c8.

serverAppConfigs-docs/Infrastructure/Homepage.md

@@ -4,9 +4,9 @@ A password-protected web site on Dankclaw lists the services that are up, with a
 
 **Served by:** Caddy, `file_server` + `forward_auth` (Authentik SSO) — **Docs:** this page
 
-## Status — 2026-08-23: deployed to production
+## Status — deployed to production (2026-08-23), on the naked domain since 2026-08-24
 
-The homepage is live on Dankclaw. `./scripts/deploy.sh dankclaw` copies the static assets to `/srv/homepage/`, installs the status checker (systemd timer, every 3 min, writes `status.json`), writes `deployed.js` (the last master deployment datetime), renders the Caddyfile (the shared basicauth hash from the host `.env`), reloads Caddy, and checks health. 146 tests pass. The Caddyfile auth uses a `route` block with `forward_auth` (see [Auth](#auth)); the caddy container mounts the host's `/srv/homepage` (not the repo source) so the generated files serve.
+The homepage is live on Dankclaw. `./scripts/deploy.sh dankclaw` copies the static assets to `/srv/homepage/`, installs the status checker (systemd timer, every 3 min, writes `status.json`), writes `deployed.js` (the last master deployment datetime), renders the Caddyfile (the shared basicauth hash from the host `.env`), reloads Caddy, and checks health. The Caddyfile auth uses a `route` block with `forward_auth` (see [Auth](#auth)); the caddy container mounts the host's `/srv/homepage` (not the repo source) so the generated files serve.
 
 **Moved to the naked domain (2026-08-24):** the homepage now serves `franksdank.cloud` and `www.franksdank.cloud`. The old names `dankclaw.franksdank.cloud` and `dankserver.franksdank.cloud` redirect to it. Authentication moved from per-page basicauth to Authentik `forward_auth` (see [Authentik](Authentik.md)).
 
@@ -28,7 +28,7 @@ The site has two pages. The root page lists the user services. The `/admin/` pag
 
 ```mermaid
 graph TD
-    subgraph site["dankclaw.franksdank.cloud (Caddy)"]
+    subgraph site["franksdank.cloud + www (Caddy)"]
         ROOT["/  user services<br/>(shared password)"]
         ADMIN["/admin/  admin services<br/>(operator password)"]
         HOW["/how/  how it is built<br/>(deferred)"]
@@ -85,7 +85,9 @@ flowchart TD
 
 **Admin services** (`/admin/`): Hermes, Grafana, Prometheus, Loki, Caddy, Pi-hole, Gluetun, the LLM fleet, and the low-level backends (mariadb, redis, Postgres, node-exporter, alloy). The backends show status only. They get a link only where a UI is meaningful.
 
-**Excluded for now:** the *arr stack (Radarr, Sonarr, Lidarr, Readarr, Prowlarr, qBittorrent). It is not started. It is a separate effort, possibly on a different host.
+**Excluded from the listing:** the *arr stack + qBittorrent (Prowlarr, Sonarr,
+Radarr, Lidarr, Readarr, qB) — live on FrankBook-Pro but operator-only: no
+vhosts, direct IP:port access only. See [[FrankBook-Pro]].
 
 ## Layout
 

serverAppConfigs-docs/Infrastructure/Prometheus.md

@@ -2,7 +2,9 @@
 
 Prometheus collects metrics from every service on Dankclaw by scraping their `/metrics` endpoints. It feeds the Grafana dashboards. The `node-exporter` containers may add podman/cgroup metrics for full host visibility.
 
-**Host:** Dankclaw — **Hostname:** `prometheus.dankclaw.local` — **Port:** 9090 — **Docs:** https://prometheus.io/docs
+**Host:** Dankclaw — **Vhost:** `prometheus.franksdank.cloud` (guarded: Anubis →
+Authentik; post-auth the Caddy vhost routes straight to `prometheus:9090`) —
+**Port:** 9090 — **Docs:** https://prometheus.io/docs
 
 ## Facts