feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

tests/scripts_syntax.bats

@@ -0,0 +1,31 @@
+#!/usr/bin/env bats
+# Seam: script syntax.
+# Every shell script in scripts/ must pass `bash -n`. When shellcheck is
+# available it must pass with no errors (warnings tolerated in this repo).
+
+load helpers
+
+@test "all scripts pass bash -n" {
+    local any=0
+    while IFS= read -r s; do
+        any=1
+        bash -n "$s" || { echo "syntax error in $s"; return 1; }
+    done < <(find "$REPO_ROOT/scripts" -name '*.sh' -type f 2>/dev/null | sort)
+    [ "$any" -eq 1 ] || skip "no scripts yet"
+}
+
+@test "scripts are executable" {
+    while IFS= read -r s; do
+        [ -x "$s" ] || { echo "$s is not executable"; return 1; }
+    done < <(find "$REPO_ROOT/scripts" -name '*.sh' -type f 2>/dev/null | sort)
+}
+
+@test "shellcheck passes when available" {
+    if command -v shellcheck >/dev/null 2>&1; then
+        while IFS= read -r s; do
+            shellcheck -S error "$s" || { echo "shellcheck errors in $s"; return 1; }
+        done < <(find "$REPO_ROOT/scripts" -name '*.sh' -type f 2>/dev/null | sort)
+    else
+        skip "shellcheck not installed locally"
+    fi
+}