docs: dissolve Stacks chapter → infra/; reconcile portmap, storage, changelog (2026-05-21)

- Move PORTMAP, storage, volumes, docker-networks from stacks/ → infra/
- Remove stacks/todo.md (content migrated to CHANGELOG + ideas)
- portmap: add new MCP servers (18005/07/09/10/11), fix s3.nuclide.systems entry,
  update Daytona OIDC row to DECOMMISSIONED, add Vaultwarden OIDC placeholder,
  add DevOps table row for MCP server Gitea repos
- storage: add Garage S3 buckets subsection (lobe-files + chat-artifacts)
- docker-networks: remove daytona-minimal_daytona-network row + daytona from
  "Stacks Keeping Own Networks" list
- ct-inventory: add CT 112 (secrets/Infisical, planned)
- CHANGELOG: prepend 2026-05-21 entry (docs, S3, MCP, dev env, Gitea repos, planned)
- ideas/stack-ideas: add §11 Renovate Bot, §12 egress firewall, §13 local LLM
- mkdocs.yml: replace nav — dissolve Stacks chapter, add infra/ entries

CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable infrastructure / service / doc changes. Newest first.
 
+## 2026-05-21
+
+### Docs & docs infrastructure
+- **Mermaid diagrams now rendering** in mkdocs Material site — was missing `custom_fences` config in `pymdownx.superfences`. Fixed in `docs-server/mkdocs.yml` and rebuilt container.
+- **`site_url` corrected** to `http://192.168.1.111:13080` (docs are LAN-only; no Zoraxy route exists).
+- **Docs restructured**: "Stacks (CT 104)" chapter dissolved; PORTMAP, Storage, Volumes, Docker networks moved to `infra/` section. TODO items migrated into CHANGELOG + ideas.
+- **Secrets manager design doc** added at `services/secrets-manager.md` — recommends Infisical on a new CT 112.
+
+### Storage / S3
+- **`s3.nuclide.systems` Zoraxy route fixed** — `EnableWebsocketCustomHeaders`, `DisableHopByHopHeaderRemoval`, `EnableAutoHTTPS` all set. Garage S3 API now reachable externally.
+- **`chat-artifacts` Garage S3 bucket created** — public-read via `https://chat-artifacts.s3.nuclide.systems/<key>`. Credentials at `/root/garage-chat-artifacts.creds` (not git-tracked).
+
+### MCP surface
+- **`upload-artifact` MCP server** deployed (port 18011, CT 104). Tools: `upload_text`, `upload_base64`, `list_artifacts`, `get_url`, `delete_artifact`. Registered in gateway (now 24 servers). Source: `git.nuclide.systems/fkrebs/mcp-upload-artifact`.
+- **ComfyUI MCP** now auto-uploads completed images to `chat-artifacts` S3 and includes the public URL alongside the inline base64 image.
+- **DAYTONA_API_KEY** removed from CT 104 `ai/.env` (Daytona decommissioned 2026-05-20).
+
+### Dev environment
+- **`savefig` dotfiles helper** added to `fkrebs/dotfiles` — uploads any file to `chat-artifacts` using `uv run --with boto3`; reads credentials from env vars.
+- **Coder `python-uv` template** updated with `CHAT_ARTIFACTS_*` env vars baked in; template pushed to Coder server.
+
+### Gitea repos
+- New repos created: `mcp-comfyui`, `mcp-docling`, `mcp-shepard`, `mcp-upload-artifact`, `home-assistant-config` — all at `git.nuclide.systems/fkrebs/`.
+- **HAOS config** (`192.168.1.60`, VM 100) has a Gitea upstream ready. Manual push needed from HA terminal (see `services/secrets-manager.md` for SSH access notes).
+
+### Planned
+- CT 112 "secrets" — Infisical deployment (see `services/secrets-manager.md`)
+- Renovate Bot via Gitea Actions — dependency updates for MCP server repos (Dockerfiles + requirements.txt)
+- Vaultwarden OIDC SSO wiring (client created in Pocket-ID 2026-05-21; auth flow not yet configured)
+- LobeHub Artifacts → S3 patch (TypeScript, ~3-4h, deferred)
+
 ## 2026-05-20
 
 ### Auth / Identity (single sign-on lockdown)