feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

docs/Architecture/Network Architecture.md

@@ -0,0 +1,54 @@
+# Network Architecture
+
+Both hosts run Caddy as the single entry point. Every service is reachable by hostname; the router firewall governs external access. On Dankclaw, SearXNG's outbound traffic exits through the Gluetun VPN container.
+
+## Topology
+
+```mermaid
+graph TB
+    subgraph WAN[Router 192.168.0.1 firewall]
+        EXT[Internet]
+    end
+    EXT -->|port forward| DS[Caddy Dankserver]
+    EXT -->|port forward| DC[Caddy Dankclaw]
+    subgraph Dankserver[192.168.0.235]
+        DS --> R[RomM :8085]
+        DS --> P[Copyparty :3923]
+        DS --> W[Calibre-Web :8083]
+    end
+    subgraph Dankclaw[192.168.0.143]
+        DC --> O[OpenWebUI :3000]
+        DC --> G[Gitea :3001]
+        DC --> F[ComfyUI :8188]
+        DC --> GR[Grafana :3002]
+        DC --> PR[Prometheus :9090]
+        DC --> SE[SearXNG :8081]
+        SE -->|network_mode service| GL[Gluetun VPN]
+        GL -->|tunnel| EXT
+    end
+```
+
+## Hostnames
+
+| Host | Convention |
+|------|------------|
+| Dankserver | `*.dankserver.local` → Caddy → service |
+| Dankclaw | `*.dankclaw.local` → Caddy → service |
+
+Users never type ports; Caddy maps names to upstreams.
+
+## Gluetun Path (SearXNG only)
+
+SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetun`). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in [[VPN Routing for SearXNG]].
+
+## Access Policy
+
+- All services assume external access is possible; the **router firewall** governs what the WAN can reach.
+- Caddy adds HTTP basic auth on the homepage and on sensitive services.
+- LAN subnet: `192.168.0.0/24`.
+
+## See Also
+
+- [[Dankserver Stack]], [[Dankclaw Stack]]
+- [[Caddy]], [[Gluetun]]
+- Knowledge base: [[VPN Routing for SearXNG]], [[SearXNG Tuning]]