feat(inventory): bring nh3-dev under infra-ops management

Adds the NH3 dev box (10.100.10.50) as a managed host: README, first
system-details snapshot, ssh-target. Adds it to the fleet bootstrap's
Tier 1 and the CLAUDE.md servers table. infra-ops identity bootstrapped
there (operator-run) — NOPASSWD sudo + key, so root-level infra work on
the box (it runs the egress proxy, ttyd seat, mead-hall, volva, and dev
checkouts) no longer needs a per-task password.

First use: installed Playwright headless-Chromium system deps + binary
for bloom_music's OSMD browser-geometry test harness; headless launch +
real SVG geometry verified.

CLAUDE.md

@@ -104,6 +104,7 @@ Observed and standardized across servers:
 | sf-r630 | iDRAC 10.250.250.110 | Anaheim | **SureFire client (PFI-managed)** — physical Dell R630, iDRAC-managed from PFI side | `servers/sf-r630/README.md` |
 | corviduo-dev | 10.250.50.152 | Anaheim | **Worldtree-team dev VM (PFI-hosted)** — runs the demo + personal + pinned Worldtree deployments vor/asset-engine talk to | `servers/corviduo-dev/README.md` |
 | nh3-docker | 10.100.50.40 | NH3 (`10.100.0.0/16`) | General-purpose Docker host (non-GPU VM on nh3-pve) | `servers/nh3-docker/README.md` |
+| nh3-dev | 10.100.10.50 | NH3 | Dev box — fleet sidecars (egress SOCKS5 proxy, ttyd seat, mead-hall, volva) + live Claude Code sessions; not a Docker-stack host | `servers/nh3-dev/README.md` |
 | nh3-pve | 10.100.250.60 | NH3 | Proxmox VE hypervisor | `servers/nh3-pve/README.md` |
 | nh3-nas | 10.100.50.50 | NH3 | Synology RS2418+ — NFS exports, rest-server-nh3, PBS-NH3 datastore backend | `servers/nh3-nas/README.md` |
 | pbs-nh3 | 10.100.50.90 | NH3 | Proxmox Backup Server — DR mirror (VM on nh3-pve, NFS datastore on nh3-nas); syncs from pbs-ana | `servers/pbs-nh3/README.md` |

scripts/bootstrap-infra-ops-fleet.sh

@@ -24,7 +24,7 @@ cd "$(dirname "$0")/.."
 PLAYBOOK=playbooks/bootstrap-infra-ops-user.yaml
 
 # Tier 1 — compute / docker hosts (where the agent recurs)
-TIER1=(irv-ml1 ana-ml2 ana-docker nh3-docker)
+TIER1=(irv-ml1 ana-ml2 ana-docker nh3-docker nh3-dev)
 # Tier 2 — PFI app VMs / LXCs
 TIER2=(pfi-ana-webhost ana-filebot pfi-pteradactyl pfi-tacticalrmm ana-nas)
 # Tier 3 — sensitive infra (DB, backup, network, hypervisors): opt-in via PFI_TIER=all

servers/nh3-dev/README.md

@@ -0,0 +1,37 @@
+# nh3-dev
+
+NH3-site **developer box** — `10.100.10.50` (WireGuard-reachable from the NH3
+subnet). General-purpose dev VM that hosts agent-fleet sidecars and live Claude
+Code sessions; **not** a Docker-stack host in the `stacks/` sense.
+
+**Reach:** `ssh 10.100.10.50` (as `lkraven`), or the dedicated agent identity
+`ssh -i ~/.ssh/infra-ops_ed25519 infra-ops@10.100.10.50` (NOPASSWD sudo).
+`infra-ops` bootstrapped here 2026-06-04 (see [`reference_infra_ops_sudo_identity`]
+in auto-memory). Note: Claude Code sessions often run **natively on this box**, so
+local Bash already executes here — no SSH-to-self needed for non-privileged work.
+
+## What runs here
+
+- **NH3 egress proxy** — durable internal-only SOCKS5 `socks5h://10.100.10.50:1080`
+  (dante, ACL'd to the WG net). Residential egress for colo services gated on their
+  datacenter IP (e.g. YouTube bot-gate). Runbook + setup committed; consumers point
+  `*_PROXY` at it.
+- **ttyd fleet driver-seat** — web/iPad seat into the zellij `Claude` session (ttyd
+  behind Caddy; OSC52 clipboard shim). User systemd services under `~/.config`.
+- **mead-hall** — Bifrost tool-provider sidecar (`:5173`), CI-deployed from
+  `vh/mead-hall`.
+- **volva** — Codex peer agent on the althing bus (single-turn oracle, systemd
+  daemon).
+- **bloom_music dev** — `~/development/bloom_music`; its `web/` test harness uses
+  Playwright headless Chromium. System deps + the managed Chromium binary
+  (`~/.cache/ms-playwright`) installed 2026-06-04 via `infra-ops`; headless launch +
+  real SVG geometry verified.
+
+## Notes
+
+- **PFI-owned Linux** — in scope for `infra-ops` management (apt, systemctl, service
+  lifecycle). Added to the fleet bootstrap's Tier 1.
+- OS: Debian 12 (bookworm). See `system-details.txt` for the latest snapshot
+  (`scripts/refresh-server-info.sh nh3-dev`).
+- Not in the colo Docker-stack topology — no `/opt/docker/compose` deploy target;
+  workloads are systemd services + dev checkouts.

servers/nh3-dev/ssh-target

@@ -0,0 +1 @@
+10.100.10.50

servers/nh3-dev/system-details.txt

@@ -0,0 +1,136 @@
+
+===== HOST =====
+
+Hostname:   nh3-dev.phasefinal.com
+Date:       2026-06-04T14:02:20-07:00
+Uptime:     up 4 weeks, 1 day, 2 hours, 58 minutes
+OS:         Debian GNU/Linux 12 (bookworm)
+Kernel:     6.1.0-45-amd64
+Arch:       x86_64
+
+===== HARDWARE =====
+
+CPU cores:  12
+CPU model:  QEMU Virtual CPU version 2.5+
+MemTotal:   15.6 GB
+MemAvailable: 3.1 GB
+
+===== GPUS =====
+
+nvidia-smi not present (no NVIDIA GPUs or driver not installed)
+
+===== FILESYSTEMS (df) =====
+
+Filesystem                    Size  Used Avail Use% Mounted on
+/dev/sda1                     245G   70G  162G  31% /
+10.100.50.50:/volume1/Backup   42T   28T   15T  67% /mnt/backup
+10.100.50.50:/volume1/smithy   42T   28T   15T  67% /mnt/smithy
+
+===== PERSISTENT MOUNTS (/etc/fstab, non-comment) =====
+
+UUID=689f8c0c-1230-43a5-93c2-6baf76867d70 /               ext4    errors=remount-ro 0       1
+UUID=97bca850-bf72-4881-ae33-23d9b68315b6 none            swap    sw              0       0
+/dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0
+10.100.50.50:/volume1/Backup /mnt/backup nfs defaults 0 0
+10.100.50.50:/volume1/smithy /mnt/smithy nfs _netdev,nofail,x-systemd.automount,vers=4.1  0 0
+
+===== TARGETED DATA PATHS =====
+
+/opt  (total: 4.0K)
+  total 8
+  drwxr-xr-x  2 root root 4096 2024-06-12 12:59 .
+  drwxr-xr-x 18 root root 4096 2026-05-06 11:00 ..
+
+/var/lib/docker  (total: 4.0K)
+
+/srv  (total: 4.0K)
+  total 8
+  drwxr-xr-x  2 root root 4096 2024-06-12 12:59 .
+  drwxr-xr-x 18 root root 4096 2026-05-06 11:00 ..
+
+
+===== DOCKER =====
+
+Server: 20.10.24+dfsg1   Client: 20.10.24+dfsg1
+
+----- docker info -----
+Containers:      1 (running 0, paused 0, stopped 1)
+Images:          164
+Runtimes:        map[io.containerd.runc.v2:{runc [] <nil>} io.containerd.runtime.v1.linux:{runc [] <nil>} runc:{runc [] <nil>}]
+Default runtime: runc
+Storage driver:  overlay2
+Root dir:        /var/lib/docker
+Server version:  20.10.24+dfsg1
+
+----- running containers -----
+NAMES     IMAGE     STATUS    PORTS
+
+----- all containers -----
+NAMES            IMAGE          STATUS
+sharp_sinoussi   b17950483b74   Exited (2) 2 weeks ago
+
+----- networks -----
+NAME      DRIVER    SCOPE
+bridge    bridge    local
+host      host      local
+none      null      local
+
+----- networks (external, non-default — worth knowing for compose external: true) -----
+
+----- named volumes -----
+VOLUME NAME   DRIVER
+
+----- compose projects currently running -----
+(none)
+
+===== COMPOSE FILES (/opt/docker/compose/) =====
+
+/opt/docker/compose not present
+
+===== CONFIG LAYOUT (/opt/docker/conf/ — top 200 entries) =====
+
+/opt/docker/conf not present
+
+===== LISTENING PORTS =====
+
+0.0.0.0:111
+0.0.0.0:22
+0.0.0.0:5173
+0.0.0.0:5175
+0.0.0.0:8765
+10.100.10.50:1080
+[::]:111
+127.0.0.1:17681
+127.0.0.1:17682
+127.0.0.1:2019
+127.0.0.1:42851
+[::]:22
+*:7681
+*:7682
+
+===== MODEL / HUGGINGFACE CACHES =====
+
+/home/lkraven/.cache/huggingface  (2.0G)
+  hub entries:
+    CACHEDIR.TAG
+    datasets--bigcode--bigcodebench-hard
+    datasets--deepvk--NonverbalTTS
+    datasets--go_emotions
+    models--pyannote--segmentation-3.0
+    models--pyannote--speaker-diarization-3.1
+    models--pyannote--speaker-diarization-community-1
+    models--pyannote--wespeaker-voxceleb-resnet34-LM
+    models--Qwen--Qwen3-Embedding-0.6B
+    models--SamLowe--roberta-base-go_emotions
+    models--sentence-transformers--all-MiniLM-L6-v2
+    models--Systran--faster-whisper-base
+
+
+===== DOCKER-ADJACENT SYSTEMD SERVICES =====
+
+containerd.service running
+docker.service running
+
+===== DONE =====
+
+Paste the above back into the chat, or pass a path as argv[1] to save.