feat(raspberrypi): add Raspberry Pi configuration section

Documents and scripts to reproduce the IPA integration on the Pi
(raspberrypi.tail13f623.ts.net, Debian 12 bookworm):

- setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting
  %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1)
- setup-docker-ipa-gid.sh: pins local docker group GID to 50010
  via groupmod --non-unique so IPA docker-access group membership
  alone grants docker socket access (mirrors NixOS lib.mkForce approach)
- README.md + CLAUDE.md: quick-start, current status, guardrails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

raspberrypi/scripts/setup-ipa-sudo.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Grant the IPA 'admins' group passwordless sudo on this Raspberry Pi.
+#
+# Writes /etc/sudoers.d/ipa-admins with NOPASSWD: ALL for the admins group.
+# Idempotent — safe to re-run.
+#
+# Run as root (or via the local 'raspi' user's NOPASSWD sudo) after
+# ipa-client-install has been completed and SSSD is active.
+#
+# Usage: sudo ./setup-ipa-sudo.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+if [ ! -f /etc/ipa/default.conf ]; then
+    echo "ERROR: /etc/ipa/default.conf not found -- is this host enrolled in FreeIPA?" >&2
+    exit 1
+fi
+
+write_if_changed /etc/sudoers.d/ipa-admins '%admins ALL=(ALL) NOPASSWD:ALL'
+chmod 0440 /etc/sudoers.d/ipa-admins
+
+visudo -c >/dev/null
+echo "Sudoers file valid. IPA admins group has NOPASSWD sudo on this host."