refactor: reorganize merged repo into clean directory structure

Reorganize the merged KNELServerBuild + PFVCluster repo:

  provisioning/    server provisioning (was ProjectCode/ +
                   Project-Includes/ + Project-ConfigFiles/)
  tests/           test suite (was Project-Tests/)
  perf/            Proxmox perf scripts (was top-level *.sh + scripts/)
  docs/            all documentation (was ProjectDocs/ + PROJECT.md +
                   K8S.md + TODO.md)
  dns-cluster-setup/  Technitium DNS cluster (unchanged)
  netinfra/        netinfra audit scripts (unchanged)
  switches/        switch configs (unchanged)
  vendor/          vendored KNELShellFramework (unchanged)

Update all internal path references from old directory names
(ProjectCode/, Project-Includes/, Project-Tests/) to the new ones
(provisioning/, tests/) across all scripts.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

provisioning/ConfigFiles/NTP/ntp.conf

@@ -0,0 +1,21 @@
+driftfile /var/lib/ntp/ntp.drift
+leapfile /usr/share/zoneinfo/leap-seconds.list
+
+# Redundant upstream time sources: pfv-netinfra-01/02 (Technitium/Pi-hole hosts
+# also serving NTP). IPs are used (not hostnames) because the knel.net name for
+# these hosts resolves to a Tailscale CGNAT address, not the LAN address, and
+# because NTP must come up before DNS is available. iburst speeds initial sync.
+server 192.168.3.252 iburst
+server 192.168.3.253 iburst
+
+# Hardened client: sync from the configured servers but never serve time to
+# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
+# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
+# address that upstream servers cannot reply to (symptoms: peers stuck in
+# .INIT. with reach 0). Use restrict rules to control access instead.
+restrict default ignore
+restrict 127.0.0.1
+restrict ::1
+restrict 192.168.3.252 nomodify notrap nopeer
+restrict 192.168.3.253 nomodify notrap nopeer
+