docs: MCP gateway git/gitlab/paper-search; CT 109 plan; new backrest/db/arcane docs

- mcp-gateway.md: 26 servers (added git, gitlab, paper-search catalog bridge);
  document --pass-environment requirement for env var passthrough in DinD bridges
- ct-inventory.md + homelab-architecture.md: CT 109 IP conflict, CT 113 live
- proxmox-state.md §16: Loki, sshwifty, Alloy, IP conflict note, sidecar table
  expanded to CT 103/111/113; build order updated
- infra/portmap.md: CT 113 db section; QNAP TS-251D (Klipper/Mainsail)
- services/backrest.md: full backup strategy doc (new)
- services/databases.md: CT 113 postgres/WAL-G/pgAdmin doc (new)
- services/arcane.md: Docker management IDE doc (new)
- CHANGELOG.md: 2026-05-22 entry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/portmap.md

@@ -83,7 +83,7 @@ All arr-stack services run behind `vpn_gluetun` container network.
 | [18005](http://192.168.1.40:18005) | Docling MCP | `docling-mcp` | — | SAIA Docling PDF→Markdown; reachable via gateway |
 | [18007](http://192.168.1.40:18007) | Kroki MCP | `kroki-mcp` | — | Diagram rendering; reachable via gateway |
 | [18009](http://192.168.1.40:18009) | Speaches | `speaches` | — | TTS/STT; LAN only |
-| ~~18010~~ | ~~Shepard MCP~~ | ~~`shepard-mcp`~~ | — | **DECOMMISSIONED 2026-05-21** — Shepard will provide a native MCP server |
+| ~~18010~~ | ~~Shepard MCP~~ | ~~`shepard-mcp`~~ | — | **DECOMMISSIONED 2026-05-21** — replaced by native `https://shepard.nuclide.systems/v2/mcp` (streamable HTTP; gateway entry: `shepard`, auth via `${SHEPARD_API_KEY}`) |
 | [18011](http://192.168.1.40:18011) | Upload-artifact MCP | `upload-artifact-mcp` | — | S3 chat-artifacts upload; reachable via gateway |
 | — | SearXNG | `searxng` | — | Internal, `shared_backend`, used by LobeHub |
 
@@ -136,7 +136,18 @@ _Traccar moved to 15000–15001 (Documents range). 19000–19001 now free._
 
 | Port | Service | Container | Public URL | Notes |
 |---|---|---|---|---|
-| 20010 (127.0.0.1 only) | pgAdmin | `pgadmin` | — | localhost only |
+| 20010 (127.0.0.1 only) | pgAdmin | `pgadmin` | — | shared-db pgAdmin, localhost only (CT 104) |
+
+---
+
+## LXC 113 — db (`192.168.1.6`)
+
+CT 113 is the dedicated postgres LXC. No public proxy routes — LAN access only.
+
+| Port | Service | Container | Notes |
+|---|---|---|---|
+| 5432 | Postgres 17 | `postgres` | LAN: `192.168.1.6:5432` — accepts app connections from all CTs |
+| 5050 | pgAdmin 4 | `pgadmin` | LAN only: `http://192.168.1.6:5050` — no Zoraxy route |
 
 ---
 
@@ -157,6 +168,19 @@ CT 111 hosts the self-hosted dev platform. Same Pocket-ID SSO as the rest.
 
 ---
 
+## QNAP TS-251D (`192.168.1.189`)
+
+Celeron J4025, 2-core. Hosts Klipper natively (not Docker).
+
+| Port | Service | Notes |
+|---|---|---|
+| 80 | Mainsail | 3D printer web UI |
+| 7125 | Moonraker | Klipper API |
+
+Config backed up daily to `git.nuclide.systems/fkrebs/klipper-config` via cron at 03:00 → covered offsite by Backrest `services/gitea` path.
+
+---
+
 ## External Services (Not on NUC Docker)
 
 Zoraxy routes to these external backends: