feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

docs/Architecture/Deployment Flow.md

@@ -0,0 +1,57 @@
+# Deployment Flow
+
+Deployment mirrors the `vllmScripts` repository: git is the single source of truth, and a `deploy.sh` script moves committed changes to the target hosts over SSH.
+
+## Workflow
+
+```mermaid
+graph LR
+    A[Edit in this repo] --> B[Commit]
+    B --> C[Push to origin]
+    C --> D[deploy.sh: pull on target]
+    D --> E[restart stack]
+    E --> F[health check]
+```
+
+1. Edit files locally in this repository.
+2. Commit and push.
+3. Run `./scripts/deploy.sh <dankclaw|dankserver>`.
+4. The script pulls the repo on the target and restarts the podman stack.
+5. It verifies service health after restart.
+
+## Deploy Script
+
+```
+./scripts/deploy.sh dankclaw          # pull + restart on Dankclaw
+./scripts/deploy.sh dankserver        # pull + restart on Dankserver
+./scripts/deploy.sh dankclaw --dry-run
+```
+
+SSH uses the existing key pair (`dank@dankclaw`, `dank@dankserver`). No passwords are stored or documented in this repo. If sudo is needed, use the interactive sudo on the target — never commit a password.
+
+## Targets
+
+| Target | Host | Stack |
+|--------|------|-------|
+| dankclaw | dank@dankclaw (192.168.0.143) | `dankclaw/` |
+| dankserver | dank@dankserver (192.168.0.235) | `dankserver/` |
+
+## Health Verification
+
+The deploy script polls the health endpoint of each service after restart. Service healthchecks are defined in each compose file. A service that fails its healthcheck is reported, not hidden.
+
+## Tests
+
+Run the test suite before pushing:
+
+```
+./tests/run.sh
+```
+
+The suite validates compose YAML, env consistency, Caddyfiles, docs completeness, and script syntax. See [[Testing Policy]].
+
+## See Also
+
+- [[Storage Policy]]
+- [[Testing Policy]]
+- [vllmScripts deployment docs](../../../vllmScripts/docs/deployment.md) — the model this follows