feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

docs/Infrastructure/Node-Exporter.md

@@ -0,0 +1,55 @@
+# Node-Exporter
+
+Node-Exporter exposes host metrics (CPU, RAM, disk, network) to Prometheus. One instance runs per host inside its own container.
+
+**Hosts:** Dankserver + Dankclaw — **Docs:** https://prometheus.io/docs/guides/node-exporter
+
+## Facts (from research)
+
+| Item | Value |
+|------|-------|
+| Image | `prom/node-exporter:latest` |
+| Port | 9100 (host) |
+| Network | `host` mode |
+| Config | `--path.procfs=/host/proc`, `--path.sysfs=/host/sys`, `--path.rootfs=/rootfs` |
+
+## Configuration
+
+```yaml
+services:
+  node-exporter:
+    image: prom/node-exporter:latest
+    restart: always
+    network_mode: host
+    pid: host
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+    command:
+      - --path.procfs=/host/proc
+      - --path.sysfs=/host/sys
+      - --path.rootfs=/rootfs
+```
+
+## Prometheus Targets
+
+Prometheus scrapes each host's node-exporter directly:
+
+| Host | Target |
+|------|--------|
+| Dankserver | `192.168.0.235:9100` |
+| Dankclaw | `192.168.0.143:9100` |
+
+These scrape jobs live in the Prometheus config; see [[Prometheus]] and [[Observability]].
+
+## Gotchas
+
+- Requires `network_mode: host` (or a published port) so Prometheus can reach 9100.
+- The `/proc`, `/sys`, and root mounts must be `read-only` (`:ro`).
+- Do not mount the same paths on both hosts' containers; each node-exporter reflects only its own host.
+
+## See Also
+
+- [[Prometheus]] — the scraper
+- [[Observability]] — the full stack