Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

scripts/docs-build.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Build infrastructure documentation.
+# Generates dynamic content then builds both internal and external MkDocs sites.
+#
+# Usage:
+#   ./scripts/docs-build.sh                  # generate + build both sites
+#   ./scripts/docs-build.sh --generate-only  # only regenerate dynamic content
+#   ./scripts/docs-build.sh --serve          # build + serve internal docs locally
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+GENERATE_ONLY=false
+SERVE=false
+for arg in "$@"; do
+    case "$arg" in
+        --generate-only) GENERATE_ONLY=true ;;
+        --serve)         SERVE=true ;;
+    esac
+done
+
+echo "==> Generating dynamic documentation..."
+
+# Service catalog from docker compose files
+if [ -d stacks/docker ]; then
+    python3 scripts/generate-service-catalog.py \
+        --stacks-dir stacks/ \
+        --output docs/generated/service-catalog.md 2>/dev/null || \
+        echo "  [skip] service catalog generator not yet implemented"
+fi
+
+# Host inventory from ansible
+python3 - <<'PYEOF' 2>/dev/null || echo "  [skip] inventory generator not yet implemented"
+import yaml, pathlib
+
+hosts_file = pathlib.Path("ansible/inventory/hosts.yml")
+out = pathlib.Path("docs/generated/host-inventory.md")
+out.parent.mkdir(parents=True, exist_ok=True)
+
+if hosts_file.exists():
+    data = yaml.safe_load(hosts_file.read_text())
+    lines = ["# Host Inventory\n", "Auto-generated from `ansible/inventory/hosts.yml`.\n\n"]
+    lines.append("| Host | Group | Role |\n|------|-------|------|\n")
+    def walk(node, parent=""):
+        if isinstance(node, dict):
+            for k, v in node.items():
+                if k == "hosts" and isinstance(v, dict):
+                    for host in v:
+                        lines.append(f"| `{host}` | `{parent}` | — |\n")
+                elif k not in ("vars", "children"):
+                    walk(v, k)
+                elif k == "children":
+                    walk(v, parent)
+    walk(data.get("all", {}))
+    out.write_text("".join(lines))
+    print(f"  Written {out}")
+PYEOF
+
+if [ "$GENERATE_ONLY" = true ]; then
+    echo "Dynamic content generated."
+    exit 0
+fi
+
+echo "==> Building internal documentation..."
+mkdocs build --config-file docs/mkdocs.yml --site-dir site/internal
+
+echo "==> Building external documentation..."
+mkdocs build --config-file docs/mkdocs-external.yml --site-dir site/external
+
+if [ "$SERVE" = true ]; then
+    echo "==> Serving internal docs at http://127.0.0.1:8000..."
+    mkdocs serve --config-file docs/mkdocs.yml
+fi
+
+echo "Documentation built successfully."