Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

stacks/docker/README.md

@@ -0,0 +1,37 @@
+# stacks/docker/
+
+Main self-hosted application stack. This directory will be populated via `git subtree`
+from the existing `docker` repo to preserve full commit history.
+
+## Migration (Phase 1 of implementation plan)
+
+```bash
+# From the repo root — do this once after initial push to Gitea:
+git subtree add --prefix=stacks/docker /home/wayne/repos/docker main --squash
+
+# To pull future updates from the source repo:
+git subtree pull --prefix=stacks/docker /home/wayne/repos/docker main --squash
+```
+
+## Services
+
+Once migrated, this directory contains:
+
+| Layer | Services |
+|-------|---------|
+| `core/` | Traefik, Authelia, CrowdSec, Docker Socket Proxy, Error Pages |
+| `apps/` | Nextcloud, Passbolt, Gitea, Gramps Web, SearXNG |
+| `monitoring/` | Beszel, Gotify, Uptime Kuma, WUD |
+
+## Quick reference
+
+```bash
+# Start all services
+./services-up.sh up -d
+
+# Validate compose interpolation (no deployment)
+./services-up.sh config
+
+# Check status
+./services-up.sh ps
+```

stacks/raspi/README.md

@@ -0,0 +1,36 @@
+# stacks/raspi/
+
+Raspberry Pi edge monitoring stack. This directory will be populated via `git subtree`
+from the existing `raspi` repo to preserve full commit history.
+
+## Migration (Phase 1 of implementation plan)
+
+```bash
+# From the repo root — do this once after initial push to Gitea:
+git subtree add --prefix=stacks/raspi /home/wayne/repos/raspi main --squash
+
+# To pull future updates from the source repo:
+git subtree pull --prefix=stacks/raspi /home/wayne/repos/raspi main --squash
+```
+
+## Services
+
+| Service | Purpose |
+|---------|---------|
+| Traefik | Reverse proxy + TLS (LetsEncrypt) |
+| Uptime Kuma | Uptime monitoring dashboard |
+| CrowdSec | Threat detection (Traefik plugin) |
+| Beszel Agent | Host metrics → central hub on docker host |
+| Docker Socket Proxy | Secure Docker API access |
+
+## Deployment
+
+The Raspberry Pi is accessed via Tailscale (`raspberrypi.tail13f623.ts.net`).
+
+```bash
+# Deploy from within the raspi/ directory on the Pi:
+./services-up.sh up -d
+
+# Or from this workstation via SSH:
+ssh wayne@raspberrypi.tail13f623.ts.net "cd ~/raspi && ./services-up.sh up -d"
+```