feat(albok): /srv/nemi/vault, a pulled clone of Prime's notes (vh/VuongKB) for Nemi's vault source (gate 1)

Prime keeps his notes at /home/lkraven/kb and syncs them with git (gitea
vh/VuongKB), so Nemi's read-only copy is a fresh clone, pulled fast-forward-only
hourly at :50 by a lkraven user timer, ahead of the ~:01 walk. As a clone it
holds only tracked notes (129 md outside dot-dirs). The untracked Muninn
output in the working copy (main/, fiction/) stays out. Readable from
lkraven's user manager, where Nemi runs.

servers/nh3-dev/README.md

@@ -239,3 +239,14 @@ carries `u:lkraven:rx`.
 ⚠ lkraven's systemd user manager started before `nemi-drop` existed, so Nemi gets in through those ACL entries
 for lkraven, NOT through the group. Do not "simplify" them away until lkraven's user manager has restarted.
 `playbooks/nh3-dev-nemi-inbox.yaml` verifies both paths.
+
+## `/srv/nemi/vault`: Prime's notes for Nemi (2026-10-15)
+
+A fresh clone of gitea `vh/VuongKB` (Prime's notes, which he syncs with git; his working copy is `/home/lkraven/kb`, never
+touched by this). Nemi's `vault` source walks it into albok's `personal/notes` (unit 4.4 ruling 6). It is read-only by
+convention: nothing writes into it but the pull. The lkraven user timer `nemi-vault-pull` (`configs/nemi-vault/`)
+runs `git pull --ff-only` hourly at :50, ahead of Nemi's walk at ~:01. A force-push upstream fails the pull loudly
+(`systemctl --user status nemi-vault-pull`) and the copy stays as it was. Re-clone it on purpose if that happens.
+Because it is a CLONE, it holds only tracked files. The untracked `main/` (Muninn job dirs) and `fiction/` (Muninn
+fiction concepts, 2,389 files) in Prime's working copy are deliberately not in it.
+