feat(raspberrypi): add Raspberry Pi configuration section

Documents and scripts to reproduce the IPA integration on the Pi
(raspberrypi.tail13f623.ts.net, Debian 12 bookworm):

- setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting
  %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1)
- setup-docker-ipa-gid.sh: pins local docker group GID to 50010
  via groupmod --non-unique so IPA docker-access group membership
  alone grants docker socket access (mirrors NixOS lib.mkForce approach)
- README.md + CLAUDE.md: quick-start, current status, guardrails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

raspberrypi/CLAUDE.md

@@ -0,0 +1,39 @@
+# raspberrypi CLAUDE.md
+
+Guardrails for Claude Code working on raspberrypi configuration.
+
+## Host
+
+`raspberrypi.tail13f623.ts.net` (100.86.56.87) — Raspberry Pi 4, Debian 12
+bookworm (aarch64). Reachable from LAN via Tailscale MagicDNS.
+
+## Production status
+
+The Raspberry Pi is a **production host** running live services (Traefik,
+Uptime Kuma, CrowdSec, Beszel agent). Treat it the same as pve1: read-only
+inspection is always fine; any script that writes to the host requires
+explicit same-session operator go-ahead.
+
+## Bootstrap access
+
+The local `raspi` account has NOPASSWD sudo and the nixos ED25519 key
+authorized. Use it to bootstrap IPA sudo rules or make root-level changes
+when `wayne` sudo is not yet working.
+
+## IPA integration
+
+- Enrolled in `SWEET.HOME` realm via `ipa-client-install`.
+- SSSD resolves IPA groups: `admins (50000)`, `docker-access (50010)`.
+- `%admins NOPASSWD:ALL` granted via `/etc/sudoers.d/ipa-admins`
+  (written by `scripts/setup-ipa-sudo.sh`).
+
+## Docker GID
+
+The local `docker` group GID is pinned to 50010 (`groupmod --non-unique`)
+so it matches the IPA `docker-access` group. Members of `docker-access`
+in IPA can run docker without any per-host group membership entry.
+Applied by `scripts/setup-docker-ipa-gid.sh`.
+
+## What must never be committed
+
+SSH private keys, passwords, API tokens, Tailscale auth keys.