feat(raspberrypi): add Raspberry Pi configuration section

Documents and scripts to reproduce the IPA integration on the Pi
(raspberrypi.tail13f623.ts.net, Debian 12 bookworm):

- setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting
  %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1)
- setup-docker-ipa-gid.sh: pins local docker group GID to 50010
  via groupmod --non-unique so IPA docker-access group membership
  alone grants docker socket access (mirrors NixOS lib.mkForce approach)
- README.md + CLAUDE.md: quick-start, current status, guardrails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

raspberrypi/README.md

@@ -0,0 +1,52 @@
+# raspberrypi
+
+Configuration scripts for `raspberrypi.tail13f623.ts.net` — Raspberry Pi 4
+running Debian 12 bookworm (aarch64). Reachable from LAN via Tailscale
+MagicDNS (`tail13f623.ts.net`).
+
+## Services
+
+- **Traefik** — reverse proxy (ports 80, 443, 8080)
+- **Uptime Kuma** — uptime monitoring
+- **CrowdSec** — intrusion detection
+- **Beszel agent** — metrics collection
+
+## IPA enrollment
+
+The Pi is enrolled in the `sweet.home` FreeIPA domain. SSSD resolves:
+- `admins (GID 50000)` — sudo access
+- `docker-access (GID 50010)` — docker socket access
+
+## Setup scripts
+
+Run these **as root** (or via `sudo`) after `ipa-client-install` completes.
+
+### 1. IPA sudo
+
+```bash
+sudo ./scripts/setup-ipa-sudo.sh
+```
+
+Writes `/etc/sudoers.d/ipa-admins` granting `%admins NOPASSWD:ALL`. After
+this, IPA users in the `admins` group can `sudo` without a password.
+
+### 2. Docker GID
+
+```bash
+sudo ./scripts/setup-docker-ipa-gid.sh
+```
+
+Pins the local `docker` group GID to 50010 to match the IPA `docker-access`
+group. Restarts `docker.socket` + `docker.service` to recreate the socket
+with the new GID. After this, IPA members of `docker-access` can run docker
+without any per-host group membership entry.
+
+## Current status
+
+| Item | Status |
+|---|---|
+| IPA enrollment | ✅ |
+| SSH (wayne) | ✅ via `raspberrypi.tail13f623.ts.net` |
+| Sudo (wayne, NOPASSWD) | ✅ `/etc/sudoers.d/ipa-admins` |
+| Docker (wayne, via IPA group) | ✅ docker group GID = 50010 |
+| Bootstrap sudo | ✅ local `raspi` user, NOPASSWD |