feat(raspberrypi): add Raspberry Pi configuration section

Documents and scripts to reproduce the IPA integration on the Pi
(raspberrypi.tail13f623.ts.net, Debian 12 bookworm):

- setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting
  %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1)
- setup-docker-ipa-gid.sh: pins local docker group GID to 50010
  via groupmod --non-unique so IPA docker-access group membership
  alone grants docker socket access (mirrors NixOS lib.mkForce approach)
- README.md + CLAUDE.md: quick-start, current status, guardrails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

raspberrypi/scripts/setup-docker-ipa-gid.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+# Pin the local 'docker' group GID to match the IPA 'docker-access' group
+# (GID 50010) so that IPA group membership alone grants docker socket access.
+#
+# On Debian, GID 50010 is already present via SSSD (the IPA group), so
+# groupmod requires --non-unique to allow the local docker group to share
+# it. The docker.socket + docker.service pair must be fully stopped before
+# removing the stale socket so systemd recreates it with the new GID.
+#
+# Idempotent — exits 0 without touching anything if the GID is already 50010.
+#
+# Run as root after setup-ipa-sudo.sh has been applied and docker is running.
+#
+# Usage: sudo ./setup-docker-ipa-gid.sh
+set -euo pipefail
+
+DOCKER_ACCESS_GID=50010
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+if ! command -v docker &>/dev/null; then
+    echo "ERROR: docker not found -- install Docker before running this script." >&2
+    exit 1
+fi
+
+current_gid=$(getent group docker | cut -d: -f3)
+if [ "$current_gid" = "$DOCKER_ACCESS_GID" ]; then
+    echo "docker group is already GID ${DOCKER_ACCESS_GID} -- nothing to do."
+    exit 0
+fi
+
+echo "Changing docker group GID: ${current_gid} -> ${DOCKER_ACCESS_GID}"
+
+# SSSD exposes GID 50010 via the IPA docker-access group, so groupmod sees
+# it as already in use. --non-unique lets the local docker group share it.
+groupmod --non-unique -g "${DOCKER_ACCESS_GID}" docker
+
+echo "Restarting docker to recreate socket with new GID..."
+systemctl stop docker.service docker.socket
+rm -f /var/run/docker.sock
+systemctl start docker.socket docker.service
+
+actual_gid=$(stat -c '%g' /var/run/docker.sock)
+if [ "$actual_gid" != "$DOCKER_ACCESS_GID" ]; then
+    echo "ERROR: socket GID is ${actual_gid}, expected ${DOCKER_ACCESS_GID}" >&2
+    exit 1
+fi
+
+echo "Done. Docker socket is now GID ${DOCKER_ACCESS_GID} (docker / docker-access)."
+echo "IPA members of the 'docker-access' group can now run docker without explicit local group membership."