chore: sync accumulated infra changes and docs

Removals: openwebui and netclaw compose + Traefik routes (both decommissioned).
Updates: litellm, n8n, vaultwarden, ai-agents, media, traefik routes, CLAUDE.md
(nodes/ports/known-issues), agent definitions.
Additions: Rongorongo tree, LinkedStorm plan, rename-bart spec, vllm brief,
tls-options and security-headers Traefik config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compose/hf-pdocker-02/traefik/dynamic-routes.yml

@@ -5,6 +5,8 @@ http:
       service: yoda
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers-allow-frames
       tls:
         certResolver: letsencrypt
 
@@ -13,6 +15,8 @@ http:
       service: mess
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers
       tls:
         certResolver: letsencrypt
 
@@ -21,6 +25,8 @@ http:
       service: mess
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers
       tls:
         certResolver: letsencrypt
 
@@ -29,6 +35,8 @@ http:
       service: wellknown
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers
       tls:
         certResolver: letsencrypt
 
@@ -37,6 +45,8 @@ http:
       service: solo
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers-allow-frames
       tls:
         certResolver: letsencrypt
 
@@ -45,6 +55,8 @@ http:
       service: vault
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers
       tls:
         certResolver: letsencrypt
 
@@ -53,9 +65,41 @@ http:
       service: git
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers
       tls:
         certResolver: letsencrypt
 
+  middlewares:
+    security-headers:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        contentTypeNosniff: true
+        frameDeny: true
+        referrerPolicy: "strict-origin-when-cross-origin"
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
+    security-headers-allow-frames:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        contentTypeNosniff: true
+        frameDeny: false
+        customFrameOptionsValue: "SAMEORIGIN"
+        referrerPolicy: "strict-origin-when-cross-origin"
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
   services:
     yoda:
       loadBalancer: