feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

docs/Dankclaw/Gluetun.md

@@ -0,0 +1,70 @@
+# Gluetun
+
+Gluetun is a lightweight VPN client container. It connects to a VPN provider (WireGuard or OpenVPN) and shares that tunnel with other containers that attach to its network namespace.
+
+**Host:** Dankclaw — **Docs:** https://github.com/qdm12/gluetun
+
+## Facts (from research, primary source)
+
+| Item | Value |
+|------|-------|
+| Image | `qmcgaw/gluetun:latest` |
+| Capabilities | `NET_ADMIN` required |
+| Device | `/dev/net/tun:/dev/net/tun` |
+| Ports published | searxng's 8081 → 8080 lives here |
+| Healthcheck | internal on `8000` (built-in) |
+
+## Required Environment
+
+```yaml
+environment:
+  VPN_SERVICE_PROVIDER: "${VPN_SERVICE_PROVIDER}"   # e.g. mullvad, protonvpn
+  VPN_TYPE: wireguard
+  WIREGUARD_PRIVATE_KEY: "${WIREGUARD_PRIVATE_KEY}" # from .env, never committed
+```
+
+- `VPN_TYPE` default is `openvpn`; WireGuard preferred when the provider supports it.
+- Provider-specific variables come from the Gluetun wiki; set them in `.env`.
+
+## Optional DNS (from research)
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `DNS_UPSTREAM_RESOLVER_TYPE` | `dot` | DNS over TLS |
+| `DNS_UPSTREAM_RESOLVERS` | `cloudflare` | upstream DoT providers |
+| `DNS_CACHING` | `on` | cache queries |
+| `BLOCK_MALICIOUS` | `on` | block malicious hostnames |
+
+Warning from the wiki: do NOT set `DNS_UPSTREAM_PLAIN_ADDRESSES` to a LAN/bridge address — DNS queries leak out of the tunnel.
+
+## Attaching a Container
+
+```yaml
+services:
+  searxng:
+    network_mode: "service:gluetun"
+    depends_on:
+      - gluetun
+```
+
+There is no need for `depends_on` for the network stack, but it orders startup cleanly.
+
+## Verify the Tunnel
+
+```bash
+podman exec gluetun curl -s ifconfig.me
+```
+
+The returned IP must differ from the host IP.
+
+## Gotchas
+
+- The container that holds the published port must be the one with the ports mapping (gluetun).
+- `restart: always` on gluetun so the tunnel reconnects after VPN drops.
+- When gluetun restarts, attached containers inherit the new network state; searxng may need a restart to re-resolve DNS.
+
+## See Also
+
+- [[SearXNG]] — the consumer of the tunnel
+- [[Dankclaw Stack]]
+- Knowledge base: [[VPN Routing for SearXNG]]