Initial commit: PFI fleet inventory, stacks, tooling, and backup pipeline

Captures the full workspace state built up to this point:

  - CLAUDE.md + README.md describing conventions and the four-host fleet
    (ana-ml2, ana-docker, nh3-docker, esh-docker-vm).
  - Per-host notes under servers/<host>/ with ssh-target fallback files
    and latest system-details snapshots (two in-compose credential leaks
    scrubbed; the upstream compose files still need to move those to .env).
  - scripts/: server_inspect.sh (read-only remote diagnostic),
    refresh-server-info.sh (dir-driven discovery + snapshot capture with
    validation warnings), add-host.sh, sync-stacks.sh (pull
    compose/conf trees), deploy-stack.sh (push with per-file diff + prompt).
  - stacks/: canonical compose for backrest, beszel, dozzle, llama-swap,
    rest-server-ana, rest-server-nh3, vllm-qwen3, plus the retired
    infinity reference. All use the .env-driven + traefik-net + homepage
    label pattern.
  - configs/restic/ana-docker/: first resticprofile config + pre-backup
    hook (Synapse pg_dump, Seafile mysqldump, Vaultwarden SQLite); templates
    for the other three hosts to come.
  - docs/pfi/: general infrastructure reference carried over.
  - .gitignore excludes .env, stacks-mirror/, and assorted secret/state
    filenames to prevent re-leaks on later commits.

.gitignore

@@ -0,0 +1,28 @@
+# Secrets — real .env files must never land here, only .env.example templates.
+.env
+.env.local
+.env.*.local
+**/.env
+!**/.env.example
+
+# Live mirror of server /opt/docker/{compose,conf}/ trees pulled by
+# sync-stacks.sh. Contains upstream compose files that can carry embedded
+# plaintext credentials (e.g. legacy seafile/paperless configs), so we
+# don't track them in git. Audited, hand-curated copies live under
+# stacks/<name>/ and are the source of truth.
+stacks-mirror/
+
+# Staged htpasswd / secrets files that might get written to /tmp during
+# helper scripts.
+htpasswd-new
+*.netrc
+
+# Editor / OS cruft
+.DS_Store
+*.swp
+*.swo
+*~
+
+# Logs
+*.log
+*.log.*