docs: dissolve Stacks chapter → infra/; reconcile portmap, storage, changelog (2026-05-21)

- Move PORTMAP, storage, volumes, docker-networks from stacks/ → infra/
- Remove stacks/todo.md (content migrated to CHANGELOG + ideas)
- portmap: add new MCP servers (18005/07/09/10/11), fix s3.nuclide.systems entry,
  update Daytona OIDC row to DECOMMISSIONED, add Vaultwarden OIDC placeholder,
  add DevOps table row for MCP server Gitea repos
- storage: add Garage S3 buckets subsection (lobe-files + chat-artifacts)
- docker-networks: remove daytona-minimal_daytona-network row + daytona from
  "Stacks Keeping Own Networks" list
- ct-inventory: add CT 112 (secrets/Infisical, planned)
- CHANGELOG: prepend 2026-05-21 entry (docs, S3, MCP, dev env, Gitea repos, planned)
- ideas/stack-ideas: add §11 Renovate Bot, §12 egress firewall, §13 local LLM
- mkdocs.yml: replace nav — dissolve Stacks chapter, add infra/ entries

infra/docker-networks.md

@@ -0,0 +1,127 @@
+# Docker Networks
+
+## Current Landscape (May 16, 2026)
+
+Each Docker Compose stack creates its own `{stack}_default` bridge network when it
+has no explicit `networks:` declaration. This has exhausted Docker's built-in
+172.x.x.x/16 address pool, triggering CIDR overlap errors.
+
+### Networks & Subnets
+
+| Network | Subnet | Containers |
+|---|---|---|
+| `bridge` (built-in) | 10.0.0.0/24 | 0 |
+| `ai-internal` | 172.31.0.0/16 | 8 |
+| `arcane_default` | 172.22.0.0/16 | 1 |
+| `arr-stack_default` | 172.21.0.0/16 | 4 |
+| `dozzle_default` | 192.168.16.0/20 | 1 |
+| `homepage_default` | 172.19.0.0/16 | 1 |
+| `immich_default` | 172.18.0.0/16 | 5 |
+| `karakeep_default` | 172.30.0.0/16 | 3 |
+| `memos_default` | 192.168.32.0/20 | 1 |
+| `n8n_default` | 172.25.0.0/16 | 1 |
+| `ntfy_default` | 172.27.0.0/16 | 1 |
+| `nuc-ai-core_default` | 172.29.0.0/16 | 1 |
+| `paperless-ngx_default` | 172.28.0.0/16 | 5 |
+| `pocketid_default` | 172.20.0.0/16 | 1 |
+| `qdrant_default` | 172.24.0.0/16 | 1 |
+| `traccar_default` | 172.26.0.0/16 | 1 |
+| `vaultwarden_default` | 192.168.64.0/20 | 1 |
+| `vpn_default` | 192.168.80.0/20 | 1 |
+
+Total: 18 user-defined bridge networks (Daytona decommissioned 2026-05-20).
+
+### Problem
+
+Docker's default address pool for user-defined bridge networks is
+172.17.0.0/16 – 172.31.0.0/16 (15 subnets max). With 15 172.x.x.x/16 networks
+already allocated, there is no room for new ones.
+
+The Daytona runner (`daytona-minimal-runner-1`) programmatically creates a
+`runner-bridge` network on startup. It fails with:
+
+```
+Error response from daemon: invalid pool request: Pool overlaps with other one
+on this address space
+```
+
+## Consolidation Plan
+
+### shared_backend Network
+
+A single shared bridge network (`shared_backend`) has been created to replace
+per-stack defaults for lightweight services that don't need isolation.
+
+### Stacks Already Migrated
+
+- arcane
+- dozzle
+- ntfy
+- qdrant
+- traccar
+- vaultwarden
+- memos
+- n8n
+- pocketid
+
+These stacks now declare:
+
+```yaml
+networks:
+  default:
+    external: true
+    name: shared_backend
+```
+
+### How to Free Subnets
+
+After migrating a stack to `shared_backend`, recreate it and prune the old network:
+
+```bash
+cd /opt/stacks/{stack} && docker compose up -d
+docker network rm {stack}_default   # after containers disconnect
+```
+
+### Stacks Keeping Own Networks
+
+These stacks have complex internal networking and should keep their own:
+
+- **immich** — 5 services with inter-dependencies
+- **paperless-ngx** — 5 services (webserver, broker, db, gotenberg, tika)
+- **arr-stack** — 5 services (rdtclient, prowlarr, audiobookshelf, shelfarr, flaresolverr)
+- **karakeep** — 3 services with chrome dependency
+- **homepage** — single service, can stay or migrate
+- **streamio** — already removed, stremio uses VPN container directly
+- **vpn** — single service, can stay or migrate
+- **ai/*_ai** — AI stacks, untouched
+
+### Long-term Fix
+
+Add `default-address-pools` to `/etc/docker/daemon.json`:
+
+```json
+{
+  "default-address-pools": [
+    {"base": "10.0.0.0/8", "size": 24}
+  ]
+}
+```
+
+This gives 65536 /24 subnets, eliminating exhaustion. Requires Docker daemon
+restart (`systemctl restart docker`), which briefly disrupts all containers.
+
+## Commands
+
+```bash
+# List all networks
+docker network ls
+
+# Inspect a network
+docker network inspect {name}
+
+# Remove unused networks
+docker network prune
+
+# Remove a specific network (must have 0 containers)
+docker network rm {name}
+```