docs: end-to-end gardening — links, stale refs, tailscale.md update

Comprehensive documentation gardening across the merged repo:

- tailscale.md: fully rewritten with current ground truth. The netinfra
  pair now runs production Technitium with all knel.net records
  replicated. Both LAN IPs resolve knel.net device names and recurse
  externally. The old "NXDOMAIN / zone is stale" findings are replaced
  with the resolved state and current recommendations.
- AGENTS.md: rewritten with Gitea-compatible clickable relative links
  to all key scripts and docs. Autonomous commit/push policy
  prominently documented. SSH user corrected to localuser.
- README.md: directory table and docs table now use clickable links.
- All .md cross-references converted to Gitea-renderable relative links.
- Stale path references (ProjectCode/, Project-Tests/, ProjectDocs/)
  updated to current names (provisioning/, tests/) across all docs.
- Stale repo name "FetchApply" / "KNELServerBuild" updated to
  "PFVCluster" in actionable docs; historical AI-review docs tagged
  with an HTML comment notice.
- REFACTORING-EXAMPLES.md: tagged as historical (pre-refactor patterns).
- tests/README.md, dns-cluster-setup/README.md, docs/DEPLOYMENT.md,
  docs/SECURITY.md: path references fixed to current structure.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

docs/charles-todo.md

@@ -1,4 +1,4 @@
-# Charles TODO - TSYS FetchApply Security Improvements
+# Charles TODO - PFVCluster Security Improvements
 
 **Priority Order:** High → Medium → Low  
 **Target:** Address security vulnerabilities and operational improvements
@@ -8,7 +8,7 @@
 ### ✅ 1. Replace Insecure Deployment Method - RESOLVED
 **Previous Issue:** `curl https://dl.knownelement.com/KNEL/FetchApply/SetupNewSystem.sh | bash`
 **Status:** Fixed in README.md - now uses secure git clone approach
-**Current Method:** `git clone this repo` → `cd FetchApply/ProjectCode` → `bash SetupNewSystem.sh`
+**Current Method:** `git clone this repo` → `cd PFVCluster/provisioning` → `bash SetupNewSystem.sh`
 
 **Remaining considerations:**
 - Consider implementing GPG signature verification for tagged releases
@@ -17,9 +17,9 @@
 ### ✅ 2. Enforce HTTPS for All Downloads - RESOLVED
 **Previous Issue:** HTTP URLs in Dell OMSA and some repository setups
 **Status:** All HTTP URLs converted to HTTPS across:
-  - `ProjectCode/Dell/Server/omsa.sh` - Ubuntu archive and Dell repo URLs
-  - `ProjectCode/legacy/prox7.sh` - Proxmox download URLs
-  - `ProjectCode/Modules/RandD/sslStackFromSource.sh` - Apache source URLs
+  - `provisioning/Dell/Server/omsa.sh` - Ubuntu archive and Dell repo URLs
+  - `provisioning/legacy/prox7.sh` - Proxmox download URLs
+  - `provisioning/Modules/RandD/sslStackFromSource.sh` - Apache source URLs
 
 **Remaining considerations:**
 - SSL certificate validation is enabled by default in wget/curl
@@ -35,7 +35,7 @@
 - Add environment variable support for sensitive data
 
 **Files to secure:**
-- `ProjectCode/ConfigFiles/SSH/AuthorizedKeys/` (entire directory)
+- `provisioning/ConfigFiles/SSH/AuthorizedKeys/` (entire directory)
 - Hard-coded hostnames in various scripts
 
 ## 🔶 MEDIUM PRIORITY (Operational Security)