homepage: add UniFi UDM cards; docs: nav map + remove misfiled artifact

- services.yaml: PFI-UDMSE (10.100.0.1, NH3 edge) under Infra - NH3,
  ESH-UDMPM (10.0.0.1) under Infra - ESH. PFI-UDMSE replaces the
  retired Fortigate 101F at NH3 — comment updated. Both use si-ubiquiti.
  Diff also folds in the previously-deployed-but-uncommitted PBS-ANA /
  PBS-NH3 / IRV section / retired NH3-SW1 cleanup, bringing the tracked
  copy in sync with what's live on esh-docker-vm.
- docs/README.md: navigation map of the docs/ tree (orientation /
  runbooks / pfi) with what-goes-where conventions.
- docs/runbooks/tea-0.14.0-linux-amd64.sha256: deleted (build artifact,
  not a runbook).
- STATUS.md: items 11 / 13 / 15 marked done; 15 leaves Matrix and
  chromadb consolidation candidates as future focused-session work.

STATUS.md

@@ -197,9 +197,9 @@ significant work lands — don't let it drift quietly.
     (against esh-vm-db), HA, pgadmin, CWA, uptime-kuma. Obsolete
     `*_offen_backup_data` exclude also removed from the restic profile.
 
-11. **Clean up retired mattermost dir** on ana-docker — compose dir at
+11. ~~**Clean up retired mattermost dir** on ana-docker~~ — **done**
-    `/opt/docker/compose/mattermost/` may still linger. Single `rm -rf`
+    (verified 2026-04-24: `/opt/docker/compose/mattermost/` does not
-    when convenient.
+    exist; no mattermost containers anywhere on the host).
 
 ### 🟩 Research / deferred / intermittent
 
@@ -209,17 +209,28 @@ significant work lands — don't let it drift quietly.
     worker stale. Workaround: Ctrl+Shift+R. Root cause investigation
     deferred.
 
-13. **UniFi controller homepage cards** (ESH-UDMPM at 10.0.0.1, PFI-UDMSE
+13. ~~**UniFi controller homepage cards**~~ — **done 2026-04-24.** Both
-    at 10.100.0.1). Auto-discovered via the Site Manager API; not yet
+    cards added to `configs/homepage/services.yaml` and pushed to
-    linked as homepage cards.
+    esh-docker-vm: `PFI-UDMSE` (10.100.0.1, UDM Pro SE) under `Infra -
+    NH3` as the new edge device replacing the retired Fortigate 101F;
+    `ESH-UDMPM` (10.0.0.1, UDM Pro Max) under `Infra - ESH`. Icon
+    `si-ubiquiti`.
 
 14. **Prune + credential-rotation scripts** as repeatable tooling (vs
     per-incident manual work).
 
 ### 🟦 Memory / documentation housekeeping
 
-15. **`docs/` organization** could use a pass — multiple READMEs and
+15. ~~**`docs/` organization** first pass~~ — **done 2026-04-24.**
-    reference files in different spots. Not urgent.
+    Removed misfiled `docs/runbooks/tea-0.14.0-linux-amd64.sha256`
+    (build artifact, not a runbook); added `docs/README.md` as a
+    navigation map describing what goes in `runbooks/` vs `pfi/` vs
+    top-level. Deeper consolidation candidates surfaced but deferred:
+    (a) `pfi/vm-102-matrix-{synapse,appservice}.md` could merge into
+    one Matrix doc; (b) `pfi/chromadb-setup.md` could fold into
+    `pfi/docker-stack.md`; (c) frontmatter-style inconsistency between
+    the VM-102 docs and the rest. Each is a deliberate content
+    decision, not housekeeping — leave for a focused session.
 
 16. **`STATUS.md` (this file) drift.** Update whenever significant work
     lands. Consider a `scripts/status-regen.sh` if manual updates

configs/homepage/services.yaml

@@ -60,7 +60,7 @@
       href: https://10.250.250.30/
       siteMonitor: https://10.250.250.30/
       icon: si-dell
-      description: iDRAC (Dell R750xs)
+      description: iDRAC (Dell R750xs) — OOB for pfi-pve @ 10.250.250.31
   - PFI-PVE:
       href: https://10.250.250.31:8006/
       siteMonitor: https://10.250.250.31:8006/
@@ -97,17 +97,24 @@
   - SF-R630-iDRAC:
       href: https://10.250.250.110/
       icon: si-dell
-      siteMonitor: https://10.250.250.110/
+      ping: 10.250.250.110
       description: Dell R630 iDRAC (SureFire tenant hardware)
+  - PBS-ANA:
+      href: https://10.250.50.90:8007/
+      icon: mdi-backup-restore
+      siteMonitor: https://10.250.50.90:8007/
+      description: Proxmox Backup Server — primary (fleet vzdump target)
 
 - Infra - NH3:
-  # NH3-Firewall (Fortigate 101F at 10.100.250.1) retired 2026-04-21 —
+  # NH3-Firewall (Fortigate 101F at 10.100.250.1) retired 2026-04-21,
-  # re-add if/when a new edge device is installed.
+  # replaced by PFI-UDMSE (UniFi UDM Pro SE at 10.100.0.1, below).
-  - NH3-SW1:
+  # NH3-SW1 (Mikrotik CRS328-24P-4S+ at 10.100.250.2) retired from
-      href: https://10.100.250.2
+  # homepage 2026-04-22.
-      icon: mdi-switch
+  - PFI-UDMSE:
-      siteMonitor: https://10.100.250.2
+      href: https://10.100.0.1
-      description: Mikrotik CRS328-24P-4S+
+      icon: si-ubiquiti
+      siteMonitor: https://10.100.0.1
+      description: UniFi Dream Machine Pro SE — gateway + controller (NH3 edge)
   - NH3-NAS:
       href: https://10.100.50.50:5001
       icon: mdi-nas
@@ -127,8 +134,32 @@
       ping: 10.100.50.42
       icon: si-ansible
       description: Ansible control node
+  - PBS-NH3:
+      href: https://10.100.50.90:8007/
+      icon: mdi-backup-restore
+      siteMonitor: https://10.100.50.90:8007/
+      description: Proxmox Backup Server — DR mirror (pulls from PBS-ANA)
+
+- Infra - IRV:
+  # Irvine site — reachable only via WireGuard tunnel from NH3.
+  # The 10.100.79.0/24 subnet is the WG tunnel IP space; these cards
+  # only light up when the WG link is healthy.
+  - IRV-ML1:
+      ping: 10.100.79.3
+      icon: mdi-brain
+      description: GPU host (bare-metal, RTX 3090 + RTX A6000, native AI stacks)
+  - IRV-ML1-Dockge:
+      href: http://10.100.79.3:5001
+      icon: si-docker
+      siteMonitor: http://10.100.79.3:5001
+      description: Docker management (irv-ml1)
 
 - Infra - ESH:
+  - ESH-UDMPM:
+      href: https://10.0.0.1
+      icon: si-ubiquiti
+      siteMonitor: https://10.0.0.1
+      description: UniFi Dream Machine Pro Max — gateway + controller (ESH)
   - ESH-Firewall:
       href: https://10.0.250.1
       icon: mdi-wall-fire

docs/README.md

@@ -0,0 +1,53 @@
+# docs/
+
+Navigation map for the documentation tree. New session? Read
+[`orientation.md`](orientation.md) first — it's the narrative overview
+of the fleet, backup architecture, governing principles, and gotchas,
+and it points at everything else.
+
+## Tree
+
+```
+docs/
+├── orientation.md            # start here — fleet overview + where-to-look guide
+├── runbooks/                 # ops runbooks (recovery, deployment phases)
+│   ├── disaster-recovery.md
+│   └── pbs-deployment.md
+└── pfi/                      # PFI-specific reference (services, models, VMs)
+    ├── chromadb-setup.md
+    ├── docker-stack.md
+    ├── model-list.md
+    ├── proxmox-vms.md
+    ├── recommended-model-settings.md
+    ├── vm-102-matrix-appservice.md
+    └── vm-102-matrix-synapse.md
+```
+
+## What goes where
+
+- **`runbooks/`** — step-by-step ops procedures. Anything you'd reach
+  for during an incident or while standing up new infrastructure.
+  Examples: disaster recovery (blast-radius tiers + restoration steps),
+  PBS deployment (9-phase rollout). New runbook → new file here.
+- **`pfi/`** — PFI-specific reference material that's too narrow for the
+  top-level CLAUDE.md but doesn't change incident response. AI model
+  inventory, recommended inference settings, Matrix bridge config,
+  Proxmox VM map. New stable reference → new file here.
+- **Top-level (`docs/orientation.md`, `docs/README.md`)** — narrative
+  guides about the workspace itself, not about specific infra.
+
+## Cross-references
+
+- Fleet topology + servers table: top-level [`CLAUDE.md`](../CLAUDE.md).
+- Open work + recent milestones: top-level [`STATUS.md`](../STATUS.md).
+- Durable cross-session facts: `~/.claude/projects/-home-lkraven-development-eshpfi-management/memory/`.
+
+## Conventions
+
+- Markdown, GitHub-flavored. CommonMark renders fine in most viewers.
+- File names are lowercase-kebab-case, descriptive. No dates in
+  filenames — git history covers that.
+- One topic per file. If a file grows past ~500 lines, look for a
+  natural split before adding more.
+- No checked-in binaries or checksums. Build/release artifacts belong
+  in a build pipeline or `tools/`, not `docs/`.