docs: dissolve Stacks chapter → infra/; reconcile portmap, storage, changelog (2026-05-21)

- Move PORTMAP, storage, volumes, docker-networks from stacks/ → infra/
- Remove stacks/todo.md (content migrated to CHANGELOG + ideas)
- portmap: add new MCP servers (18005/07/09/10/11), fix s3.nuclide.systems entry,
  update Daytona OIDC row to DECOMMISSIONED, add Vaultwarden OIDC placeholder,
  add DevOps table row for MCP server Gitea repos
- storage: add Garage S3 buckets subsection (lobe-files + chat-artifacts)
- docker-networks: remove daytona-minimal_daytona-network row + daytona from
  "Stacks Keeping Own Networks" list
- ct-inventory: add CT 112 (secrets/Infisical, planned)
- CHANGELOG: prepend 2026-05-21 entry (docs, S3, MCP, dev env, Gitea repos, planned)
- ideas/stack-ideas: add §11 Renovate Bot, §12 egress firewall, §13 local LLM
- mkdocs.yml: replace nav — dissolve Stacks chapter, add infra/ entries

ideas/stack-ideas.md

@@ -238,6 +238,42 @@ For ad-hoc needs, use LiteLLM as the adapter and point LobeChat at it via the ex
 
 ---
 
+## 11. Dependency updates via Renovate Bot (Gitea Actions)
+
+Run **Renovate Bot** as a Gitea Actions workflow to automatically open PRs for outdated
+dependencies in MCP server repos (`mcp-comfyui`, `mcp-docling`, `mcp-shepard`,
+`mcp-upload-artifact`). Targets: `Dockerfile` base image tags + `requirements.txt` /
+`pyproject.toml` Python deps.
+
+Renovate supports Gitea natively via `platform: gitea` in `renovate.json`. The Gitea
+Actions runner (`ct111-runner`) already exists; add a scheduled workflow calling
+`renovate/renovate` Docker image once daily.
+
+---
+
+## 12. Egress firewall on UDM (UniFi)
+
+Enforce outbound allow-list on the UDM / UniFi gateway — block all non-approved egress
+by default. Goals:
+- Prevent exfiltration from compromised containers
+- Audit unexpected outbound connections (model providers, analytics, telemetry)
+- Approved: LiteLLM model provider endpoints, Jottacloud, UNAS internal, NTP, DNS
+
+Implementation: UDM firewall rules (WAN_OUT) + Threat Management IDS in monitor mode first.
+
+---
+
+## 13. Local LLM on Arc GPU via vllm / ollama for sensitive workloads
+
+Run a privacy-sensitive LLM locally on the Arc iGPU using **vllm** (with XPU/IPEX backend)
+or the Intel-patched **Ollama** build. Use cases: document classification in Paperless
+workflows, offline coding assistant, fallback when cloud rate limits hit.
+
+See §3 (On-device LLM) for implementation notes. This item tracks the specific motivation
+of *sensitive workload isolation* — i.e., running prompts that should not leave the LAN.
+
+---
+
 ## Priority order (rough)
 
 1. **ComfyUI MCP async queue** — fixes timeout; unblocks img2img + reference features
@@ -246,3 +282,5 @@ For ad-hoc needs, use LiteLLM as the adapter and point LobeChat at it via the ex
 4. **Observability LXC** — OTEL collector + VictoriaMetrics + Grafana + Uptime Kuma, co-located
 5. **Backblaze B2 off-site backup** — already in todos
 6. **On-device LLM (Arc)** — depends on IPEX-LLM + Ollama Intel build stability
+7. **Renovate Bot** — low-effort automation win for MCP repos
+8. **Egress firewall** — security hygiene; plan before adding more external-facing services