docs: lock in storage philosophy and PDM migration capability

Storage philosophy (user directive):
- NVMe/SSD: k8s worker scratch + ultix-streaming (dev workstation
  running "cluster of 1" pre-prod jobs before full k8s deployment)
- Spinning rust: all infrastructure VMs (UCS, netinfra, LibreNMS, SIEM)

Clarified that hosts are standalone but managed via Proxmox Datacenter
Manager (PDM), which supports VM migration between nodes through the
UI -- eliminating the need for manual disk copies in the migration plan.

Updated all migration steps to reference PDM storage migrate instead
of manual cp commands.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

TODO.md

@@ -217,12 +217,11 @@ servers for redundancy.
 | ucs-01 (108) | D2 (tsys4 HDD) | **D2 (tsys4 HDD) -- no change** | Already correct |
 | ucs-02 (902) | D5 (tsys4 HDD) | **S2 (tsys5 HDD)** | Move for cross-server redundancy |
 
-**To migrate ucs-02 to S2:**
-1. Shut down VM 902 on tsys9
-2. Copy disk: `cp /mnt/pve/D5/902/vm-902-disk-0.qcow2 /mnt/pve/S2/902/`
-3. Update VM 902 config: change `scsi0` from `D5:902/...` to `S2:902/...`
-4. Start VM 902, verify it boots and LDAP/AD services are healthy
-5. Remove old disk from D5
+**To migrate ucs-02 to S2 (use PDM/Proxmox UI):**
+1. In Proxmox Datacenter or the node UI, select VM 902 on tsys9
+2. Use "Migrate" or "Storage Migrate" to move the disk from D5 to S2
+   (both are NFS exports visible to tsys9, so this is a storage-only migration)
+3. Verify VM 902 boots and LDAP/AD services are healthy after migration
 
 Note: both VMs are currently on tsys4 HDD, which is fine for UCS. Only
 ucs-02 needs to move -- it should be on a different storage server than