Doc audit: fix all broken links + correct stale facts across the KB

Fanned out 5 read-only doc-auditor subagents (one per service group) that
fact-checked the knowledge base against the live system + repo config,
researched official setup docs online, and verified progress. Applied:
- All 34 broken links fixed (real pages / external URLs / correct relative
  paths); 0 broken links remain. No .AGENTTRASH links (the 4 mentions are
  accurate descriptive text, not links).
- Fact-check fixes: Readarr retired (May 2026), Radarr v4->v6, Calibre
  9.2.1 live, Calibre-Web 0.6.25 live, Copyparty v1.20.21, LLM index
  ncmoe 38 + 786432 ctx, frank-default-small active (not frank-pp-worker),
  Hermes/SearXNG/Grafana hostnames, Loki/Alloy local images, Observability
  diagram (Promtail->Alloy), VLLM retired note, DFlash status, benchmark
  live-drift notes, Homepage test count 116.

docs/Architecture/Network Architecture.md

@@ -46,7 +46,7 @@ Caddy holds one Let's Encrypt certificate per vhost, issued and renewed through
 
 ## Gluetun Path (SearXNG only)
 
-SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetun`). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in [[VPN Routing for SearXNG]].
+SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetun`). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in [[Gluetun]].
 
 ## Access Policy
 
@@ -60,4 +60,4 @@ SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetu
 - [[Caddy]] — vhost map, TLS, basic auth
 - [[Dankserver Stack]], [[Dankclaw Stack]]
 - [[Gluetun]]
-- Knowledge base: [[VPN Routing for SearXNG]], [[SearXNG Tuning]]
+- Knowledge base: [[Gluetun]], [[SearXNG]]