Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

.gitea/workflows/docs-build.yml

@@ -0,0 +1,61 @@
+name: Documentation Build
+
+on:
+  push:
+    paths:
+      - "docs/**"
+      - "stacks/**"
+      - "ansible/inventory/**"
+      - "mkdocs.yml"
+      - "scripts/docs-build.sh"
+  workflow_dispatch:
+
+jobs:
+  generate-and-build:
+    name: Generate + build docs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          pip install mkdocs mkdocs-material mkdocs-awesome-pages-plugin
+          pip install jinja2 pyyaml
+
+      - name: Generate dynamic content
+        run: ./scripts/docs-build.sh --generate-only
+
+      - name: Build internal docs
+        run: mkdocs build --config-file docs/mkdocs.yml --site-dir site/internal
+
+      - name: Build external docs
+        run: mkdocs build --config-file docs/mkdocs-external.yml --site-dir site/external
+
+      - name: Deploy internal docs
+        if: github.ref == 'refs/heads/main'
+        # Deploy to Gitea Pages or internal server — configure PAGES_URL in secrets
+        env:
+          PAGES_SSH_KEY: ${{ secrets.PAGES_SSH_KEY }}
+          PAGES_HOST: ${{ secrets.PAGES_HOST }}
+          PAGES_PATH: ${{ secrets.PAGES_PATH_INTERNAL }}
+        run: |
+          if [ -n "$PAGES_SSH_KEY" ]; then
+            install -m 600 /dev/null /tmp/pages_key
+            echo "$PAGES_SSH_KEY" > /tmp/pages_key
+            rsync -avz --delete -e "ssh -i /tmp/pages_key -o StrictHostKeyChecking=no" \
+              site/internal/ "${PAGES_HOST}:${PAGES_PATH}/"
+          else
+            echo "PAGES_SSH_KEY not configured — skipping deploy"
+          fi
+
+      - name: Upload docs artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: docs-site
+          path: site/
+          retention-days: 7