infra: full IaC state after hf-pdocker-01 rebuild (2026-03-08)

Replaces initial Nomad/Consul/Terraform skeleton with current Docker-based
infrastructure across all three nodes (hf-pdocker-01, hf-pdocker-02, bart).

Key changes:
- CLAUDE.md: updated service distribution reflecting hf-pdocker-01 restored
- docs/plans/2026-03-08-hf-pdocker-01-rebuild.md: new rebuild plan doc
- compose/bart/: ai-agents, guacamole, matrix, media, openvas, smarthome, watchtower
- compose/hf-pdocker-02/: traefik, monitoring, adguard, gitea, semaphore, wikijs,
  unifi, vaultwarden, actual-budget, mcpo, netclaw, trivy, watchtower, n8n
- compose/hf-pdocker-01/: frigate, frigate-notify, farm-agent
- stacks/: all Swarm stack definitions (monitoring, traefik, smarthome, matrix,
  guacamole, media, ai-agents, frigate, gitea, semaphore, wikijs, unifi, etc.)
- .gitignore: exclude .env credential files and acme.json certs
- .env.example: placeholder credential files for all services
- .claude/agents/: gitea-backup and other infrastructure agent configs
- scripts/: frigate media cleanup and NAS sync scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

compose/bart/openvas/.env.example

@@ -0,0 +1,2 @@
+OPENVAS_USERNAME=admin
+OPENVAS_PASSWORD=change_me

compose/bart/openvas/docker-compose.yml

@@ -0,0 +1,34 @@
+services:
+  openvas:
+    image: immauss/openvas:latest
+    container_name: openvas
+    restart: unless-stopped
+    environment:
+      - PASSWORD=${OPENVAS_PASSWORD}
+      - USERNAME=${OPENVAS_USERNAME}
+    volumes:
+      - openvas-db:/data/database
+      - openvas-var-lib:/data/var-lib
+      - openvas-local-share:/data/local-share
+      - openvas-local-etc:/data/local-etc
+      - openvas-var-log:/data/var-log
+    ports:
+      - "9392:9392"
+    mem_limit: 6G
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+volumes:
+  openvas-db:
+    driver: local
+  openvas-var-lib:
+    driver: local
+  openvas-local-share:
+    driver: local
+  openvas-local-etc:
+    driver: local
+  openvas-var-log:
+    driver: local