docs: end-to-end gardening — links, stale refs, tailscale.md update

Comprehensive documentation gardening across the merged repo:

- tailscale.md: fully rewritten with current ground truth. The netinfra
  pair now runs production Technitium with all knel.net records
  replicated. Both LAN IPs resolve knel.net device names and recurse
  externally. The old "NXDOMAIN / zone is stale" findings are replaced
  with the resolved state and current recommendations.
- AGENTS.md: rewritten with Gitea-compatible clickable relative links
  to all key scripts and docs. Autonomous commit/push policy
  prominently documented. SSH user corrected to localuser.
- README.md: directory table and docs table now use clickable links.
- All .md cross-references converted to Gitea-renderable relative links.
- Stale path references (ProjectCode/, Project-Tests/, ProjectDocs/)
  updated to current names (provisioning/, tests/) across all docs.
- Stale repo name "FetchApply" / "KNELServerBuild" updated to
  "PFVCluster" in actionable docs; historical AI-review docs tagged
  with an HTML comment notice.
- REFACTORING-EXAMPLES.md: tagged as historical (pre-refactor patterns).
- tests/README.md, dns-cluster-setup/README.md, docs/DEPLOYMENT.md,
  docs/SECURITY.md: path references fixed to current structure.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

docs/claude-todo.md

@@ -1,4 +1,4 @@
-# Claude TODO - TSYS FetchApply Automation Tasks
+# Claude TODO - TSYS PFVCluster Automation Tasks
 
 **Purpose:** Actionable items optimized for AI assistant implementation  
 **Priority:** Critical → High → Medium → Low
@@ -11,9 +11,9 @@
 
 ### ✅ RESOLVED: Replace HTTP URLs with HTTPS
 **Files modified:**
-- `ProjectCode/Dell/Server/omsa.sh` - Converted 11 HTTP URLs to HTTPS (Ubuntu archive, Dell repo)
-- `ProjectCode/legacy/prox7.sh` - Converted 2 HTTP URLs to HTTPS (Proxmox downloads)
-- `ProjectCode/Modules/RandD/sslStackFromSource.sh` - Converted 3 HTTP URLs to HTTPS (Apache sources)
+- `provisioning/Dell/Server/omsa.sh` - Converted 11 HTTP URLs to HTTPS (Ubuntu archive, Dell repo)
+- `provisioning/legacy/prox7.sh` - Converted 2 HTTP URLs to HTTPS (Proxmox downloads)
+- `provisioning/Modules/RandD/sslStackFromSource.sh` - Converted 3 HTTP URLs to HTTPS (Apache sources)
 
 **Status:** All HTTP URLs in active scripts converted to HTTPS. Only remaining HTTP references are in comments and LibreNMS agent files (external dependencies).
 
@@ -39,7 +39,7 @@ function verify_download() {
 ```
 
 ### TASK-003: Create Secure Deployment Script
-**Create:** `ProjectCode/SecureSetupNewSystem.sh`
+**Create:** `provisioning/SecureSetupNewSystem.sh`
 **Features to implement:**
 - GPG signature verification
 - SHA256 checksum validation
@@ -50,9 +50,9 @@ function verify_download() {
 
 ### TASK-004: Remove Hardcoded SSH Keys
 **Files to modify:**
-- `ProjectCode/ConfigFiles/SSH/AuthorizedKeys/root-ssh-authorized-keys`
-- `ProjectCode/ConfigFiles/SSH/AuthorizedKeys/localuser-ssh-authorized-keys`
-- `ProjectCode/Modules/Security/secharden-ssh.sh:31,40,51`
+- `provisioning/ConfigFiles/SSH/AuthorizedKeys/root-ssh-authorized-keys`
+- `provisioning/ConfigFiles/SSH/AuthorizedKeys/localuser-ssh-authorized-keys`
+- `provisioning/Modules/Security/secharden-ssh.sh:31,40,51`
 
 **Implementation approach:**
 1. Create environment variable support: `SSH_KEYS_URL` or `SSH_KEYS_VAULT_PATH`
@@ -119,7 +119,7 @@ function update_status() { }        # Update current operation
 ```
 
 ### TASK-012: Dry Run Mode
-**Add to:** `ProjectCode/SetupNewSystem.sh`
+**Add to:** `provisioning/SetupNewSystem.sh`
 **Implementation:**
 - `--dry-run` flag support
 - Preview of changes without execution
@@ -139,9 +139,9 @@ function update_status() { }        # Update current operation
 ## File Location Patterns
 
 - **Framework components:** `Framework-Includes/*.sh`
-- **Security modules:** `ProjectCode/Modules/Security/*.sh`
-- **Configuration files:** `ProjectCode/ConfigFiles/*/`
-- **Main entry point:** `ProjectCode/SetupNewSystem.sh`
+- **Security modules:** `provisioning/Modules/Security/*.sh`
+- **Configuration files:** `provisioning/ConfigFiles/*/`
+- **Main entry point:** `provisioning/SetupNewSystem.sh`
 
 ## Testing Strategy