docs: lock in storage philosophy and PDM migration capability

Storage philosophy (user directive):
- NVMe/SSD: k8s worker scratch + ultix-streaming (dev workstation
  running "cluster of 1" pre-prod jobs before full k8s deployment)
- Spinning rust: all infrastructure VMs (UCS, netinfra, LibreNMS, SIEM)

Clarified that hosts are standalone but managed via Proxmox Datacenter
Manager (PDM), which supports VM migration between nodes through the
UI -- eliminating the need for manual disk copies in the migration plan.

Updated all migration steps to reference PDM storage migrate instead
of manual cp commands.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

netinfra/deep-audit-netboot.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# deep-audit-netboot.sh — READ-ONLY deep inspection. Uses `sudo` for docker/root files.
+set -u
+DG="sudo docker"
+
+hdr() { printf '\n=== %s ===\n' "$1"; }
+
+hdr "COMPOSE FILES: /root/pihole and /root/NTP"
+for f in /root/pihole/docker-compose.yml /root/NTP/docker-compose.yml; do
+    printf '\n--- %s ---\n' "$f"
+    sudo cat "$f" 2>&1
+done
+
+hdr "DIR LAYOUT of compose project dirs"
+sudo ls -la /root/pihole 2>&1
+sudo ls -la /root/NTP 2>&1
+sudo ls -la /root 2>&1
+
+hdr "SEARCH entire FS for any technitium / dns compose files"
+sudo find / -xdev -maxdepth 6 \( -iname 'docker-compose.y*ml' -o -iname 'compose.y*ml' \) -print 2>/dev/null \
+    | grep -Ei 'dns|technitium|tsys' || true
+
+hdr "ALL CONTAINERS with compose labels"
+$DG ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\tWDIR={{.Label "com.docker.compose.project.working_dir"}}\tCFG={{.Label "com.docker.compose.project.config_files"}}\tSVC={{.Label "com.docker.compose.service"}}' 2>&1
+
+hdr "DOCKER INSPECT pihole + tsys-ntp (and any dns/technitium container)"
+for c in $($DG ps -aq 2>/dev/null); do
+    nm=$($DG inspect --format '{{.Name}} | image={{.Config.Image}} | proj={{index .Config.Labels "com.docker.compose.project"}}' "$c" 2>/dev/null)
+    printf '\n###### %s ######\n' "$nm"
+    $DG inspect "$c" 2>&1
+done
+
+hdr "PI-HOLE internal config (sudo docker exec, READ-ONLY)"
+echo "-- ls /etc/pihole --";          $DG exec pihole ls -la /etc/pihole 2>&1 || true
+echo "-- ls /etc/dnsmasq.d --";       $DG exec pihole ls -la /etc/dnsmasq.d 2>&1 || true
+for f in setupVars.conf pihole-FTL.conf adlists.list custom.list local.list regex.list dhcp.leases static_ip.conf; do
+    echo "--- /etc/pihole/$f ---"; $DG exec pihole cat "/etc/pihole/$f" 2>&1 || true
+done
+echo "-- /etc/dnsmasq.d/* --"
+$DG exec pihole sh -c 'for f in /etc/dnsmasq.d/*; do echo "--- $f ---"; cat "$f"; done' 2>&1 || true
+echo "-- pihole version --";          $DG exec pihole pihole -v 2>&1 || true
+echo "-- gravity row counts --"
+$DG exec pihole sh -c 'for t in adlist domainlist client "group" info; do printf "%s=" "$t"; sqlite3 /etc/pihole/gravity.db "SELECT COUNT(*) FROM $t;" 2>/dev/null; done' 2>&1 || true
+echo "-- adlist addresses --"
+$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT address,enabled,comment FROM adlist;" 2>&1 || true
+echo "-- domainlist (allow+deny, first 60) --"
+$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT type,domain,enabled,comment FROM domainlist LIMIT 60;" 2>&1 || true
+
+hdr "CHRONY/NTP container config (tsys-ntp)"
+$DG exec tsys-ntp sh -c 'echo "--- chrony.conf ---"; cat /etc/chrony/chrony.conf 2>/dev/null || cat /etc/chrony.conf 2>/dev/null || echo none; echo "--- ls /etc ---"; ls -la /etc 2>/dev/null | head -30' 2>&1 || true
+$DG exec tsys-ntp chronyc -n sources 2>&1 || true
+$DG exec tsys-ntp chronyc -n tracking 2>&1 || true
+echo "-- bare metal ntpsec.conf --"; sudo cat /etc/ntpsec/ntp.conf 2>&1
+
+hdr "TECHNITIUM volumes"
+for v in dns_tsys-dns-config dns_tyss-dns-config; do
+    mnt=$($DG volume inspect --format '{{.Mountpoint}}' "$v" 2>/dev/null)
+    printf '\n--- volume %s -> %s ---\n' "$v" "$mnt"
+    [ -n "$mnt" ] || continue
+    sudo find "$mnt" -maxdepth 4 -type f 2>/dev/null | head -80
+    echo "-- config dir listing --"
+    sudo ls -laR "$mnt"/config 2>/dev/null | head -60 || sudo ls -laR "$mnt" 2>/dev/null | head -60 || true
+    echo "-- config.xml --"
+    sudo cat "$mnt"/config/config.xml 2>/dev/null | head -250 || true
+done
+
+hdr "DONE"