feat(raspberrypi): add Raspberry Pi configuration section

Documents and scripts to reproduce the IPA integration on the Pi
(raspberrypi.tail13f623.ts.net, Debian 12 bookworm):

- setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting
  %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1)
- setup-docker-ipa-gid.sh: pins local docker group GID to 50010
  via groupmod --non-unique so IPA docker-access group membership
  alone grants docker socket access (mirrors NixOS lib.mkForce approach)
- README.md + CLAUDE.md: quick-start, current status, guardrails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -7,10 +7,11 @@ service type.
 ## Layout
 
 ```
-proxmox/   Proxmox VE hosts (pve1 production, pve-test sandbox)
-pihole/    Pi-hole DNS/DHCP (config snapshots, pull/apply scripts)
-freeipa/   FreeIPA identity management server (domain-controller.sweet.home)
-scripts/   Repo-wide scripts (secret scanning, git hook installer)
+proxmox/      Proxmox VE hosts (pve1 production, pve-test sandbox)
+pihole/       Pi-hole DNS/DHCP (config snapshots, pull/apply scripts)
+freeipa/      FreeIPA identity management server (domain-controller.sweet.home)
+raspberrypi/  Raspberry Pi 4 (Debian 12, IPA-enrolled, Docker host)
+scripts/      Repo-wide scripts (secret scanning, git hook installer)
 ```
 
 ## Sections
@@ -34,6 +35,13 @@ LDAP, and integrated DNS for the `sweet.home` realm. See
 `freeipa/README.md` for the quick-start and `freeipa/docs/install.md`
 for the full reproduction procedure.
 
+### `raspberrypi/`
+
+Raspberry Pi 4 running Debian 12 bookworm (`raspberrypi.tail13f623.ts.net`,
+reachable from LAN via Tailscale MagicDNS). IPA-enrolled; runs Traefik,
+Uptime Kuma, CrowdSec, and Beszel. See `raspberrypi/README.md` for
+setup scripts and current status.
+
 ## Secret scanning
 
 All commits are scanned for secrets by a CI pipeline that runs on both