docs(vault): fleet-wide fact re-verification pass (67 pages)

The docs-fact census wave re-read the live hosts and re-keyed every page
it could: runtime/payload identities, ports, sizes, ledger figures, unit
state, and the retirement banners that drifted as the fleet moved. The
wave was interrupted mid-run, so this commit carries only what passed the
integrity gates: every touched page parses (front matter or H1+status
convention intact, balanced fences, no truncated tables, trailing
newline), the docs_completeness and link-integrity seams are green, and
bats is 384/384.

Numbers that this session proved on live hosts are keyed to the measured
value, not the page's earlier claim.

serverAppConfigs-docs/Architecture/Network Architecture.md

@@ -4,7 +4,7 @@ description: "One Caddy fronts both hosts."
 tags:
   - architecture
   - network
-timestamp: 2026-09-02
+timestamp: 2026-10-18
 ---
 
 # Network Architecture
@@ -40,7 +40,7 @@ graph TB
         POST --> PROM[Prometheus :9090]
         DIRECT -->|3000 + ssh 2222| GITEA[Gitea]
         DIRECT -->|3005| OWEBUI[OpenWebUI]
-        DIRECT -->|3002| GRAFANA[Grafana :3000]
+        POST -->|authenticated| GRAFANA[Grafana :3000]
         DIRECT -->|8083 web UI| PIHOLE[Pi-hole]
         AUTH -->|login UI + sessions| AUTHDB[(Authentik Postgres :5432)]
         SEARCH -.->|tunnel exit| GLU[Gluetun VPN]
@@ -53,21 +53,31 @@ graph TB
         CAL[Calibre-Web :8083]
         PLEX[Plex :32400]
         JEL[Jellyfin :8096]
-        ARR[*arr stack + qBittorrent]
     end
 
     POST -->|romm| ROMM
+    subgraph FRANKBOOK["FrankBook-Pro 192.168.0.112"]
+        ARR[*arr stack + qBittorrent]
+    end
     POST -->|files| COPY
     DIRECT -->|plex plain-HTTP passthrough| PLEX
     DIRECT --> CAL
     DIRECT --> JEL
-    DIRECT --> ARR
+    DIRECT -->|own auth, no Anubis| ARR
 ```
 
-Guarded (through Anubis): homepage, search, prometheus, romm, files.
-Exempt by construction: `auth.` (the IdP login itself), plex (plain HTTP),
-gitea (git smart-HTTP clients cannot solve JS challenges — `/info/refs` and
-`git-*-pack` pass unchallenged), grafana (own auth).
+Guarded (Anubis `:8923` → Caddy `:8016` → Authentik outpost → Caddy `:8017`):
+homepage (`www.`), search, **grafana** (`dankclaw/Caddyfile:128-129`),
+prometheus (`:135-137`), loki (`:141-143`), seerr (`:148-150`), marreta
+(`:155-160`), romm (`:167-169`), files (`:172-174`). Exempt / own-auth: `auth.`
+(the IdP login itself), `ai.` (OpenWebUI, its own OIDC), gitea (git smart-HTTP
+clients cannot solve JS challenges — `/info/refs` and `git-*-pack` pass
+unchallenged), pihole (Caddy `basicauth`, `:167`), plex (plain HTTP),
+books/jellyfrank (own logins), `hermes.`/`hermesadmin.`, and the *arr vhosts
+that terminate on FrankBook-Pro (`:254-281`, "exempt by construction: own
+auth"). Grafana is **not** exempt even though it signs in through authentik as
+an OAuth2 relying party (`:123`) — the chain wraps it too. `sonarr.` has no
+vhost at all (LAN `192.168.0.112:8989` only, `:265-267`).
  
  Dankserver runs no proxy of its own. Its services expose published LAN ports, and the Dankclaw Caddy routes the names to those ports.
 
@@ -78,20 +88,31 @@ gitea (git smart-HTTP clients cannot solve JS challenges — `/info/refs` and
 | LAN | `romm.franksdank.cloud` → 192.168.0.143 | Pi-hole (`addn-hosts`) |
 | WAN | `romm.franksdank.cloud` → 71.227.227.172 | Porkbun A record |
 
-Users type a name and nothing else. Caddy maps the name to the upstream. The split between the two resolvers removes the need for router NAT loopback. See [[LAN-DNS]] for the flow and the router hand-off.
+Users type a name and nothing else. Caddy maps the name to the upstream. The
+split between the two resolvers removes the need for router NAT loopback.
+Verified 2026-10-18: `dig +short @192.168.0.143 romm.franksdank.cloud` →
+192.168.0.143, and a public resolver returns 71.227.227.172 for the same name.
+See [[LAN-DNS]] for the flow and the router hand-off.
 
 ## TLS
 
 Caddy holds one Let's Encrypt certificate per vhost, issued and renewed through the DNS-01 challenge via the Porkbun module. No inbound port 80/443 is required. Details in [[Caddy]].
 
-## Gluetun Path (SearXNG only)
+## Gluetun Path (SearXNG + Marreta)
 
-`gluetun.container`, `searxng.container` and `searxng-valkey.container` all set
-`Network=searxng.network` in their Quadlet sources (runtime network
-`systemd-searxng`); only those three share the tunnel. The old compose idiom
-(`network_mode: service:gluetun`) is gone — a shared named network is what
-carries SearXNG's outbound traffic through the VPN exit. Everything else on
-Dankclaw uses the normal LAN route. This matches KB Pattern 2 in [[Gluetun]].
+`gluetun.container` and `searxng-valkey.container` set
+`Network=searxng.network` (runtime network `systemd-searxng`), while
+`searxng.container`, `marreta.container` and `marreta-browser.container` join
+the tunnel the modern way — `Network=gluetun.container`
+(`dankclaw/searxng/quadlet/searxng.container:18`,
+`dankclaw/marreta/quadlet/marreta.container:34`,
+`dankclaw/marreta/quadlet/marreta-browser.container:25`), the Quadlet
+equivalent of the retired compose `network_mode: service:gluetun`. **Five**
+containers share the VPN exit, not three, and Marreta's outbound fetches leave
+through the same WireGuard tunnel as SearXNG's. Pi-hole is a different kind of
+exception (`Network=slirp4netns`, `dankclaw/pihole/quadlet/pihole.container`);
+everything else on Dankclaw uses the normal LAN route. This matches KB Pattern
+2 in [[Gluetun]].
 See [[Container Network Namespaces]] for which addresses are reachable from that
 namespace (none of the unpublished host-netns listeners).