docs: migrate Authentik (SSO keystone) to edge2 CT 105

- Authentik -> edge2 CT 105 (Postgres pg_dump/restore; SECRET_KEY carried verbatim; zero-downtime until ~2s cutover)
- Multi-block Caddy cutover: auth.echo6.co + notes.echo6.co outpost/forward_auth -> 100.64.0.36:9000
- runbook: add reboot tailscale-before-docker gotcha; clarify dnsmasq must NOT be repointed (points at Caddy host)
- source left stopped + intact on Contabo as cold rollback

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

engine/.githooks/pre-commit

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# .githooks/pre-commit — Vault lint report hook
+#
+# Runs lint.py in REPORT mode (never --strict) so it writes lint-report.md
+# and always exits 0. This hook MUST NOT block commits — the root autocommit
+# cron (echo6-agent) depends on commits succeeding unconditionally.
+#
+# To wire: git config core.hooksPath engine/.githooks
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+LINT="${REPO_ROOT}/engine/lib/lint.py"
+
+if [[ ! -f "${LINT}" ]]; then
+    echo "[lint] WARNING: lint.py not found at ${LINT}, skipping." >&2
+    exit 0
+fi
+
+echo "[lint] Running vault lint (report mode)..." >&2
+python3 "${LINT}" >&2 || true  # || true: never fail the commit
+
+# Always exit 0 — do NOT change this to exit 1 or add --strict.
+exit 0