feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

docs/Architecture/Storage Policy.md

@@ -0,0 +1,40 @@
+# Storage Policy
+
+All persistent data uses **bind mounts**: a host directory mapped directly into the container. No named volumes. This matches the preference of this repo and the existing Gitea stack on Dankclaw.
+
+## Why Bind Mounts
+
+- The exact host location of every byte is visible and controllable.
+- Backups are a simple `tar` of known host directories.
+- The data survives container recreation and `podman-compose down`.
+- Ownership is explicit: everything runs as UID 1000 (`dank`) so host tools can read it.
+
+## Conventions
+
+| Stack | Host root |
+|-------|-----------|
+| Dankserver | `/opt/<service>/...` |
+| Dankclaw | `/opt/<service>/...` (Gitea keeps `/opt/gitea/data/...`) |
+
+## Ownership
+
+Containers run as `PUID=1000` / `PGID=1000`. Host directories must be owned by `dank`:
+
+```bash
+sudo chown -R 1000:1000 /opt/<service>
+```
+
+## Secrets
+
+Secrets never live in bind-mounted configs that get committed. They are:
+
+1. Set in `.env` files on the host (git-ignored, `.env.example` committed as template), or
+2. Injected as environment variables from the deploy script.
+
+The live Gitea database password exists only in `.env` on Dankclaw. A test enforces that it never appears in this repo.
+
+## See Also
+
+- [[Deployment Flow]]
+- [[Gitea]] — the existing bind-mount stack being migrated
+- [[Backblaze Integration]] — future backup target for these mounts