chore: sync accumulated infra changes and docs

Removals: openwebui and netclaw compose + Traefik routes (both decommissioned).
Updates: litellm, n8n, vaultwarden, ai-agents, media, traefik routes, CLAUDE.md
(nodes/ports/known-issues), agent definitions.
Additions: Rongorongo tree, LinkedStorm plan, rename-bart spec, vllm brief,
tls-options and security-headers Traefik config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compose/gpu-machine/friday-voice/Dockerfile.hermes

@@ -0,0 +1,17 @@
+# Overlay on the friday-voice app image that adds the docker CLI + a wrapper so
+# the container can reach the hermes agent via `docker exec hermes hermes ...`.
+# Runs as root to access the mounted /var/run/docker.sock.
+FROM friday-voice:latest
+
+USER root
+
+# Static docker *client* only (~small), for `docker exec` into the hermes container.
+RUN curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz \
+      | tar -xz --strip-components=1 -C /usr/local/bin docker/docker \
+    && chmod +x /usr/local/bin/docker \
+    && docker --version
+
+COPY hermes-wrap /usr/local/bin/hermes-wrap
+RUN chmod +x /usr/local/bin/hermes-wrap
+
+# Keep the base image's CMD (uvicorn friday_voice.app:app :8320).