docs: migrate Authentik (SSO keystone) to edge2 CT 105

- Authentik -> edge2 CT 105 (Postgres pg_dump/restore; SECRET_KEY carried verbatim; zero-downtime until ~2s cutover)
- Multi-block Caddy cutover: auth.echo6.co + notes.echo6.co outpost/forward_auth -> 100.64.0.36:9000
- runbook: add reboot tailscale-before-docker gotcha; clarify dnsmasq must NOT be repointed (points at Caddy host)
- source left stopped + intact on Contabo as cold rollback

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

engine/config.yaml

@@ -0,0 +1,54 @@
+# Echo6 Vault Engine — configuration (single source of truth for the engine)
+vault_dir: /home/zvx/projects/.ref/vault
+engine_dir: /home/zvx/projects/.ref/engine
+
+models:
+  tagger:
+    ollama_endpoint: http://localhost:11434
+    model: vault-tagger            # built by bootstrap from Modelfile
+    base_model: qwen2.5:7b-instruct-q8_0
+    temperature: 0.1
+    format: json
+  embeddings:
+    tei_endpoint: http://localhost:8090   # existing bge-m3 service (reuse)
+    model: bge-m3
+    qdrant_endpoint: http://localhost:6333
+    qdrant_collection: vault_docs
+
+# Stable topic-tag vocabulary (tier 1). The entity lexicon (tier 2) is GENERATED into vocab.json.
+topic_categories:
+  - mesh
+  - matrix
+  - recon
+  - media
+  - auth
+  - dns
+  - vpn
+  - storage
+  - proxmox
+  - ai
+  - mail
+
+# Read-only inventory sources for the generated entity lexicon (tier 2)
+inventory:
+  proxmox_nodes: [data, utility, cloud, media, toc]   # pct list / qm list
+  proxmox_vps: [contabo, edge2]                        # pct list
+  docker_hosts: [cortex, utility, media, contabo]      # docker ps
+  headscale_host: contabo                              # headscale nodes list
+  ssh_user: zvx
+
+# Frontmatter property schema enforced by lint
+frontmatter_schema:
+  required: [title, type, tags, updated]
+  optional: [aliases, related, status]
+  types: [reference, runbook, project, note, index, session]
+
+behavior:
+  auto_apply: true            # write changes directly...
+  log_changes: true           # ...but log every change for audit/revert
+  changelog: /home/zvx/projects/.ref/engine/changelog.md
+  confidence_threshold: 0.6   # below this, flag in changelog instead of silent
+
+schedule:
+  cron: "0 9 * * *"           # 09:00 UTC daily (off-peak); guard checks GPU before running
+  defer_if_gpu_busy_mib: 6000 # skip/defer if >this much VRAM already in use