feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

dankserver/.env.example

@@ -0,0 +1,7 @@
+# Dankserver stack secrets and configuration.
+# Copy to .env and fill real values. Never commit real secrets.
+
+# RomM admin credentials (first boot)
+ROMM_USERNAME=changeme
+ROMM_PASSWORD=changeme
+ROMM_SECRET_KEY=changeme

dankserver/Caddyfile

@@ -0,0 +1,56 @@
+# Dankserver Caddyfile
+# Migrated from the live /etc/caddy/Caddyfile on dankserver, extended with the
+# new stack services. Native caddy (systemd) on this host; upstreams are host
+# ports because the services publish to the host.
+
+{
+	admin off
+	email admin@dankserver.local
+}
+
+# --- Homepage (password protected) ---
+dankserver.local {
+	basicauth {
+		dank $2a$14$REPLACE_WITH_HASH
+	}
+	root * /srv/homepage
+	file_server
+}
+
+# --- Plex (existing, kept) ---
+plex.franksdank.casa {
+	reverse_proxy localhost:32400
+}
+
+plex.franksdank.cloud {
+	reverse_proxy localhost:32400
+}
+
+plex.dankserver.local {
+	reverse_proxy localhost:32400
+}
+
+# --- Calibre-Web (existing, kept) ---
+books.franksdank.cloud {
+	reverse_proxy localhost:8083
+}
+
+books.dankserver.local {
+	reverse_proxy localhost:8083
+}
+
+# --- RomM ---
+romm.dankserver.local {
+	basicauth {
+		dank $2a$14$REPLACE_WITH_HASH
+	}
+	reverse_proxy localhost:8085
+}
+
+# --- Copyparty ---
+files.dankserver.local {
+	basicauth {
+		dank $2a$14$REPLACE_WITH_HASH
+	}
+	reverse_proxy localhost:3923
+}

dankserver/compose.yaml

@@ -0,0 +1,76 @@
+# Dankserver stack — media & library services.
+# Deploy: cd /home/dank/serverAppConfigs && podman-compose -f dankserver/compose.yaml up -d
+# See ../docs/Dankserver/ for service documentation.
+
+services:
+  romm:
+    image: ghcr.io/rommapp/romm:latest
+    container_name: romm
+    restart: unless-stopped
+    environment:
+      ROMM_USERNAME: "${ROMM_USERNAME}"
+      ROMM_PASSWORD: "${ROMM_PASSWORD}"
+      ROMM_SECRET_KEY: "${ROMM_SECRET_KEY}"
+    ports:
+      - "8085:8080"
+    volumes:
+      - /opt/romm/library:/romm/library
+      - /opt/romm/resources:/romm/resources
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  copyparty:
+    image: ghcr.io/9001/copyparty:latest
+    container_name: copyparty
+    restart: unless-stopped
+    ports:
+      - "3923:3923"
+    volumes:
+      - /opt/copyparty/data:/data
+    healthcheck:
+      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:3923/')"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  calibre-web:
+    image: lscr.io/linuxserver/calibre-web:latest
+    container_name: calibre-web
+    restart: unless-stopped
+    environment:
+      PUID: "1000"
+      PGID: "1000"
+      TZ: Etc/UTC
+    ports:
+      - "8083:8083"
+    volumes:
+      - /opt/calibre-web/config:/config
+      - /opt/calibre-web/books:/books
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8083/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  node-exporter:
+    image: prom/node-exporter:latest
+    container_name: node-exporter
+    restart: unless-stopped
+    network_mode: host
+    pid: host
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+    command:
+      - --path.procfs=/host/proc
+      - --path.sysfs=/host/sys
+      - --path.rootfs=/rootfs
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:9100/metrics"]
+      interval: 30s
+      timeout: 10s
+      retries: 3