fleet: register 9 hosts surfaced by gap-analysis audit

Six PFI VMs/LXCs previously known only via proxmox_inspect.sh —
covered by vzdump but not in servers/, so operational context
(roles, backup posture, ssh target) was missing:

  pfi-ana-webhost  (VMID 110)  — web workload
  ana-filebot      (LXC  112)  — file-task automation
  pfi-pteradactyl  (VMID 107)  — Pterodactyl game panel
  pfi-tacticalrmm  (VMID 111)  — TacticalRMM remote-management
  pfi-postgres     (VMID 105)  — shared Postgres (vaultwarden/gitea/
                                 paperless backends)
  ana-wg           (LXC  113)  — WireGuard VPN gateway

Plus three SureFire tenant hosts at the Anaheim colo:

  sfsrv-ana        — tenant Proxmox hypervisor (10.250.250.115:8006)
  sf-ana-container — container workload on that Proxmox
  sf-r630          — physical R630 (iDRAC 10.250.250.110 for PFI-side
                     hardware mgmt; OS is tenant-scoped)

Each server dir has README + ssh-target where applicable. SureFire
entries explicitly document tenancy scope: PFI provides hosting,
SureFire owns the OS; management actions need tenant coordination.
SureFire hosts have no ssh-target by default.

Homepage Infra - ANA gains two new cards:
  - SFsrv-ANA (https://10.250.250.115:8006, si-proxmox icon)
  - SF-R630-iDRAC (https://10.250.250.110, si-dell icon)
PFI-ANA-ML2 BMC gained an href since it has a usable web UI.

CLAUDE.md fleet table extended with all 9 new rows. Placement-rules
section notes the SureFire tenant boundary.

Memory: new project_surefire_tenant.md so future sessions know sf-*
hosts are tenant-scoped by default.

servers/ana-wg/README.md

@@ -0,0 +1,37 @@
+# ana-wg
+
+WireGuard VPN gateway at the Anaheim colo.
+
+## Network
+
+- **LAN IP:** 10.250.50.252
+- **SSH:** `root@ana-wg` (LXC — root via key)
+
+## Infrastructure
+
+- **Hypervisor:** `pfi-pve` (**LXC 113**)
+- **Type:** LXC container
+- **Site:** Anaheim (PFI colo)
+
+## Role
+
+WireGuard server providing VPN access into the PFI Anaheim network.
+Config lives at `/etc/wireguard/` inside the LXC.
+
+## Backup coverage
+
+- **VM-image:** ✅ vzdump on pfi-pve (daily) — captures the LXC rootfs
+  which contains the wireguard config + peer keys. Sufficient for
+  disaster recovery.
+- **File-level restic:** ❌ not needed — no DB, no high-churn state,
+  config is small and recoverable from vzdump.
+
+## Refresh state
+
+```bash
+scripts/refresh-server-info.sh ana-wg
+```
+
+## Discovered via
+
+FortiGate DHCP (MAC `bc:24:11:d7:e4:b7`).

servers/ana-wg/ssh-target

@@ -0,0 +1 @@
+root@10.250.50.252