fleet: re-frame SureFire hosts from tenant-only to PFI-managed

Initial framing was wrong. PFI runs these under a managed-hosting
agreement: SSH, OS ops, backups are all PFI's responsibility. Hardware
and data belong to the client.

Changes:
- ssh-target files added for sfsrv-ana (root@10.250.250.115 — same
  pattern as other PVE nodes) and sf-ana-container
  (lkraven@10.250.150.100 guess, adjust if different user).
- sf-r630 still lacks an ssh-target — the OS-side LAN IP isn't in
  FortiGate DHCP (static config somewhere). Will fill in once
  identified; README flags that gap.
- READMEs rewritten: dropped "tenant-scoped" / "not SSH-managed"
  language, added "client context" section that explains the
  managed-hosting relationship. Backup coverage now listed as
  planned rather than blocked on tenant coordination.
- CLAUDE.md fleet table: SF rows re-labeled "SureFire client
  (PFI-managed)". Placement-rules section updated to note that
  SF hosts are first-class PFI-ops targets, just client-owned.
- Memory (project_surefire_tenant.md) rewritten to reflect
  managed-services reality + hosts-file entries needed for name
  resolution since these aren't in PFI DNS.

servers/sfsrv-ana/README.md

@@ -1,49 +1,52 @@
 # sfsrv-ana
 
-**SureFire tenant Proxmox host** at the Anaheim colo. Third-party
-equipment / workload — tracked here for inventory, backup coverage,
-and network awareness.
+SureFire-client Proxmox hypervisor at the Anaheim colo. Client-owned
+equipment but **PFI-managed** under the hosting agreement — we have SSH
+and are responsible for operations.
 
-## Tenancy
+## Client context
 
-- **Owner:** SureFire (tenant)
-- **PFI role:** hosting provider — provides rack, power, network
-- **Management scope:** coordinate with SureFire before any action
+- **Client:** SureFire (SF prefix is SF-client hosts)
+- **PFI role:** full-service managed host (rack, power, network, OS
+  ops, backups)
 
 ## Network
 
 - **LAN IP:** 10.250.250.115
+- **FQDN:** not yet in DNS / `/etc/hosts` — add a line to the
+  workstation's hosts file to make short-name resolution work:
+  ```
+  10.250.250.115  sfsrv-ana
+  ```
 - **Web UI:** https://10.250.250.115:8006 (Proxmox VE)
-- **SSH:** not currently wired into this workspace (tenant equipment).
-  If PFI ever gains admin access, add `ssh-target` here.
+- **SSH:** `root@10.250.250.115` (key auth — same pattern as other PVE nodes)
 
 ## Infrastructure
 
 - **Type:** Proxmox VE hypervisor (bare metal)
 - **Site:** Anaheim (PFI colo)
 
-Hosts SureFire's own VMs, including:
-- `sf-ana-container` (10.250.150.100) on the container subnet
+Hosts SureFire's VMs, including:
+- `sf-ana-container` (10.250.150.100) on the dedicated SF container subnet
 
 ## Backup coverage
 
-- **Not currently backed up by the PFI fleet.**
-- User flagged this as **needing coverage** — open plan item. Options:
-  1. Coordinate tenant-side backup of SureFire VMs using their own
-     target.
-  2. If PFI is responsible for backups of tenant workloads under the
-     hosting agreement, deploy restic clients to SureFire VMs writing
-     into a segregated repo on `rest-server-ana` (e.g. a dedicated
-     htpasswd user + encryption key scoped to SureFire).
-  3. File-level Proxmox vzdump into shared NAS storage, same pattern
-     as pfi-pve.
-- Decision pending.
+- **VM-image:** status unknown — probe with
+  `scripts/refresh-proxmox-info.sh sfsrv-ana` once SSH is verified.
+  If no vzdump jobs are configured, set them up the same as pfi-pve
+  (daily 01:00 into a network target).
+- **File-level restic:** not yet configured.
+
+This is on the open work list — once we've validated SSH + refreshed
+the Proxmox snapshot, add a `configs/restic/sfsrv-ana/` profile if
+it's running hosted workloads whose state we care about beyond the
+VM-image layer.
 
 ## Refresh state
 
-Not wired into `refresh-proxmox-info.sh` — would require SSH access as
-root (same flow as pfi-pve / nh3-pve / etc.). Add an `ssh-target` when
-ready.
+```bash
+scripts/refresh-proxmox-info.sh sfsrv-ana
+```
 
 ## Discovered via
 

servers/sfsrv-ana/ssh-target

@@ -0,0 +1 @@
+root@10.250.250.115