infra: full IaC state after hf-pdocker-01 rebuild (2026-03-08)

Replaces initial Nomad/Consul/Terraform skeleton with current Docker-based
infrastructure across all three nodes (hf-pdocker-01, hf-pdocker-02, bart).

Key changes:
- CLAUDE.md: updated service distribution reflecting hf-pdocker-01 restored
- docs/plans/2026-03-08-hf-pdocker-01-rebuild.md: new rebuild plan doc
- compose/bart/: ai-agents, guacamole, matrix, media, openvas, smarthome, watchtower
- compose/hf-pdocker-02/: traefik, monitoring, adguard, gitea, semaphore, wikijs,
  unifi, vaultwarden, actual-budget, mcpo, netclaw, trivy, watchtower, n8n
- compose/hf-pdocker-01/: frigate, frigate-notify, farm-agent
- stacks/: all Swarm stack definitions (monitoring, traefik, smarthome, matrix,
  guacamole, media, ai-agents, frigate, gitea, semaphore, wikijs, unifi, etc.)
- .gitignore: exclude .env credential files and acme.json certs
- .env.example: placeholder credential files for all services
- .claude/agents/: gitea-backup and other infrastructure agent configs
- scripts/: frigate media cleanup and NAS sync scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

compose/hf-pdocker-02/netclaw/entrypoint.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+set -e
+
+# Configure OpenClaw environment
+mkdir -p /root/.openclaw
+
+# Write .env with API key
+cat > /root/.openclaw/.env << EOF
+ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
+EOF
+
+# Write openclaw config for gateway mode
+cat > /root/.openclaw/openclaw.json << 'OCEOF'
+{
+  "mode": "gateway",
+  "provider": "anthropic",
+  "model": "claude-sonnet-4-6",
+  "fallbackModel": "claude-haiku-4-5-20251001",
+  "name": "Aaron",
+  "identity": "Aaron - NetClaw AI Network Engineering Agent"
+}
+OCEOF
+
+# Copy workspace skills if they exist
+if [ -d /opt/netclaw/workspace/skills ]; then
+    cp -r /opt/netclaw/workspace/skills /root/.openclaw/workspace/ 2>/dev/null || true
+fi
+
+# Copy personality/identity docs
+for doc in SOUL.md AGENTS.md IDENTITY.md USER.md TOOLS.md; do
+    if [ -f /opt/netclaw/$doc ]; then
+        cp /opt/netclaw/$doc /root/.openclaw/ 2>/dev/null || true
+    fi
+done
+
+# Send Matrix DM to Jeremy to announce availability
+if [ -n "$MATRIX_ACCESS_TOKEN" ] && [ -n "$MATRIX_HOMESERVER" ]; then
+    echo "Sending Matrix DM to Jeremy..."
+
+    # Create a direct message room with Jeremy
+    ROOM_RESPONSE=$(curl -sf -X POST "${MATRIX_HOMESERVER}/_matrix/client/r0/createRoom" \
+        -H "Content-Type: application/json" \
+        -H "Authorization: Bearer ${MATRIX_ACCESS_TOKEN}" \
+        -d "{
+            \"is_direct\": true,
+            \"invite\": [\"@jeremy:hobbs.farm\"],
+            \"preset\": \"trusted_private_chat\"
+        }" 2>/dev/null || echo "")
+
+    ROOM_ID=$(echo "$ROOM_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('room_id',''))" 2>/dev/null || echo "")
+
+    if [ -n "$ROOM_ID" ]; then
+        # Send the message
+        curl -sf -X PUT "${MATRIX_HOMESERVER}/_matrix/client/r0/rooms/${ROOM_ID}/send/m.room.message/$(date +%s%N)" \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${MATRIX_ACCESS_TOKEN}" \
+            -d "{
+                \"msgtype\": \"m.text\",
+                \"body\": \"Hey Jeremy - Aaron here. I'm online and ready to help with network engineering tasks. I'm running NetClaw with CCIE-level networking skills. Ask me about device health checks, routing analysis, security audits, or anything network-related.\"
+            }" 2>/dev/null || echo "Failed to send DM"
+        echo "DM sent to @jeremy:hobbs.farm in room $ROOM_ID"
+    else
+        echo "Warning: Could not create DM room with Jeremy. Response: $ROOM_RESPONSE"
+    fi
+fi
+
+# Start OpenClaw gateway
+echo "Starting NetClaw (Aaron) gateway..."
+exec openclaw gateway 2>&1 || {
+    echo "OpenClaw gateway failed to start, keeping container alive for debugging..."
+    tail -f /dev/null
+}