chore: sync accumulated infra changes and docs

Removals: openwebui and netclaw compose + Traefik routes (both decommissioned).
Updates: litellm, n8n, vaultwarden, ai-agents, media, traefik routes, CLAUDE.md
(nodes/ports/known-issues), agent definitions.
Additions: Rongorongo tree, LinkedStorm plan, rename-bart spec, vllm brief,
tls-options and security-headers Traefik config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/traefik/dynamic/vaultwarden.yml

@@ -4,6 +4,8 @@ http:
       rule: "Host(`vault.hobbs.farm`)"
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers
       service: vault
       tls:
         certResolver: letsencrypt