docs: migrate Authentik (SSO keystone) to edge2 CT 105

- Authentik -> edge2 CT 105 (Postgres pg_dump/restore; SECRET_KEY carried verbatim; zero-downtime until ~2s cutover)
- Multi-block Caddy cutover: auth.echo6.co + notes.echo6.co outpost/forward_auth -> 100.64.0.36:9000
- runbook: add reboot tailscale-before-docker gotcha; clarify dnsmasq must NOT be repointed (points at Caddy host)
- source left stopped + intact on Contabo as cold rollback

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

vault/docs/software/dns.md

@@ -0,0 +1,64 @@
+# GoDaddy DNS Management
+
+## Script Location
+
+`~/bin/godaddy-dns.py`
+
+## API Credentials
+
+Stored in `/home/zvx/projects/.ref/credentials` as:
+- `GODADDY_API_KEY`
+- `GODADDY_API_SECRET`
+
+## Key IPs for DNS Records
+
+| Purpose | IP |
+|---------|-----|
+| External (home services) | `199.6.36.163` |
+| Contabo Server | `5.189.158.149` |
+
+## Managed Domains
+
+arclightvanguard.com, echo6.co, echo6.org, happylittlellc.com, idahomesh.com, k7zvx.com, lpmesh.com, maliceinwonderland.org, matthewwayne.com, smugglersden.co, underdogs.cc
+
+## Usage Examples
+
+```bash
+# List all domains
+godaddy-dns.py list-domains
+
+# List records for a domain
+godaddy-dns.py list echo6.co
+
+# Add A record
+godaddy-dns.py add-a echo6.co www 199.6.36.163
+
+# Add CNAME record
+godaddy-dns.py add-cname echo6.co blog www.echo6.co
+
+# Add MX record with priority
+godaddy-dns.py add-mx echo6.co mail.echo6.co --priority=10
+
+# Delete record
+godaddy-dns.py delete echo6.co A www
+
+# Configure MX for all domains
+godaddy-dns.py setup-mail
+```
+
+## Common Patterns
+
+### Point subdomain to home network
+```bash
+godaddy-dns.py add-a echo6.co newservice 199.6.36.163
+```
+
+### Point subdomain to Contabo
+```bash
+godaddy-dns.py add-a echo6.co auth 5.189.158.149
+```
+
+### Create CNAME alias
+```bash
+godaddy-dns.py add-cname echo6.co alias target.echo6.co
+```