feat(raspberrypi): add Raspberry Pi configuration section

Documents and scripts to reproduce the IPA integration on the Pi
(raspberrypi.tail13f623.ts.net, Debian 12 bookworm):

- setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting
  %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1)
- setup-docker-ipa-gid.sh: pins local docker group GID to 50010
  via groupmod --non-unique so IPA docker-access group membership
  alone grants docker socket access (mirrors NixOS lib.mkForce approach)
- README.md + CLAUDE.md: quick-start, current status, guardrails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -6,9 +6,9 @@ OVERRIDE any default behaviour and must be followed exactly.
 ## Repo purpose
 
 Configuration toolsets and docs for Wayne's Debian-based LAN machines.
-Three sections currently exist: `proxmox/` (Proxmox VE hosts),
-`pihole/` (Pi-hole DNS/DHCP), and `freeipa/` (FreeIPA identity
-management). Each has its own README.
+Four sections currently exist: `proxmox/` (Proxmox VE hosts),
+`pihole/` (Pi-hole DNS/DHCP), `freeipa/` (FreeIPA identity management),
+and `raspberrypi/` (Raspberry Pi 4). Each has its own README.
 
 ## Safety rules (apply everywhere in this repo)
 
@@ -40,6 +40,10 @@ management). Each has its own README.
   management server (`domain-controller.sweet.home`, VMID 108 on `pve1`).
   All scripts that SSH into the server are production operations — treat
   them as off-limits without an explicit same-session go-ahead.
+- **Raspberry Pi:** see `raspberrypi/CLAUDE.md` — production host running
+  live services; same write-authorisation rules as `pve1`. Bootstrap access
+  via local `raspi` user (NOPASSWD sudo). IPA-enrolled; docker GID pinned
+  to 50010 to match IPA `docker-access` group.
 
 ## Adding a new machine type