docs: OKF v0.1 compliance pass + fact-check + 3 research briefs

- Migrate all 127 non-reserved docs to OKF v0.1 frontmatter (type/description/tags/timestamp); fix 13 YAML issues, 2 duplicate-FM blocks, strip reserved-page FM
- Restructure log.md to OKF (## YYYY-MM-DD, newest-first)
- Fact-check against scripts/AGENTS.md ground truth: fix 6 false 'Active' banners on retired runbooks, 96->114 GiB GTT, deployment.md vs deploy-plan.py/deploy-remote.sh, Deployment Flow frank-medium=Quadlet, Calibre 9.9.0->9.15.0 + CVE-2025-7404 conflation, Copyparty v1.20.24, RomM 5.3.0 breaking change
- Move *arr docs to new FrankBook-Pro/ section (git mv, link-safe)
- Write active runbook bodies from ground truth (frank-large, frank-small)
- Add 3 research briefs + HTML report: Local TTS and Voice Cloning, AI Job Search and Resume Tools, Most Popular Self-Hosted AI Apps (Jun-Sep 2026)
- Add upstream-version rows to ComfyUI/OpenWebUI/Hermes app docs
- All 336 tests pass; 136 pages, 0 unresolved wikilinks

serverAppConfigs-docs/Architecture/Deployment Flow.md

@@ -62,13 +62,14 @@ service on the other host.
 |---|---|---|
 | Dankclaw compose services | `podman-compose -f dankclaw/compose.yaml up -d --no-deps NAME` | Recreates only `NAME`; Caddy is handled separately because it fronts both hosts. |
 | SearXNG, Gluetun, Valkey, OpenWebUI, Pi-hole, Gitea database/server | user Quadlet + `systemctl --user` | Installs the selected unit and restarts only the required dependency-coupled units. Gitea's web proxy is the canonical Caddy compose service. |
-| `frank-large` | systemd + `systemctl` | Relinks and restarts only the large inference service; waits up to 20 minutes for `/health`. |
-| `frank-medium` | systemd + `systemctl` | Retires the legacy frank-small unit on first deploy, then relinks and restarts only the inference service; waits up to 20 minutes for `/health`. |
+| `frank-large` | systemd + `systemctl` (root unit) | Relinks and restarts only the large inference service; waits up to 20 minutes for `/health`. |
+| `frank-small` | systemd + `systemctl` (root unit) | Relinks and restarts only the small inference service; waits up to 20 minutes for `/health`. |
+| `frank-medium` | rootless Quadlet + `systemctl --user` | Installs `dankserver/frank-medium/quadlet/frank-medium.container`; on first deploy retires the llama.cpp root unit and the vLLM replica quadlets into the home trash, then restarts the generated unit. Waits up to 20 minutes for `/health`. |
 | Dankserver media stack (RomM trio, Jellyfin, Calibre-Web, Copyparty) | user Quadlet + `systemctl --user` | Installs `dankserver/<svc>/quadlet/*.container`, restarts the generated unit. The first cutover per service is idempotent: it retires the compose-era bare container, rescues any anonymous volume into the data root, and merge-moves `/opt/<svc>` to `/home/dank/Containers/<svc>` (mapped-uid roots move without chown). Steady state is restart-only. |
 
 The shared chat template maps to the inference service on the selected target.
-The inactive `frank-npu` unit is relink-only when explicitly selected;
-it is not restarted by an unrelated large-model deployment.
+The `frank-npu` endpoint is retired (2026-09-11) and has no deploy handler;
+an unrelated large-model deployment never touches it.
 
 ## Caddy safety
 

serverAppConfigs-docs/Architecture/E2E Suite.md

@@ -1,3 +1,13 @@
+---
+type: reference
+description: "`tests/e2e/` drives the **live fleet** through a real browser: fresh contexts"
+tags:
+  - architecture
+  - e2e
+  - homepage
+timestamp: 2026-09-01
+---
+
 # E2E Suite — homepage + guard chain (Playwright)
 
 `tests/e2e/` drives the **live fleet** through a real browser: fresh contexts

serverAppConfigs-docs/Architecture/Network Architecture.md

@@ -1,3 +1,12 @@
+---
+type: reference
+description: "One Caddy fronts both hosts."
+tags:
+  - architecture
+  - network
+timestamp: 2026-09-02
+---
+
 # Network Architecture
 
 One Caddy fronts both hosts. It runs as a container on Dankclaw (192.168.0.143) and terminates TLS for every service on the LAN. Pi-hole on Dankclaw answers the service names for LAN clients; Porkbun answers them for the WAN. The G36 router firewall governs external access. SearXNG outbound traffic exits through the Gluetun VPN container.

serverAppConfigs-docs/Architecture/Storage Policy.md

@@ -1,3 +1,12 @@
+---
+type: reference
+description: "All persistent data uses **bind mounts**: a host directory mapped directly into the container."
+tags:
+  - architecture
+  - storage
+timestamp: 2026-09-01
+---
+
 # Storage Policy
 
 All persistent data uses **bind mounts**: a host directory mapped directly into the container. No named volumes. This matches the preference of this repo and the existing Gitea stack on Dankclaw.

serverAppConfigs-docs/Architecture/Testing Policy.md

@@ -1,3 +1,12 @@
+---
+type: reference
+description: "This repository tests its configuration at defined seams."
+tags:
+  - architecture
+  - testing
+timestamp: 2026-09-01
+---
+
 # Testing Policy
 
 This repository tests its configuration at defined seams. The tests run with `bats`; run them with `./tests/run.sh` before every push.