SMB-default for Nexa volumes (user confirmed NFS+unpriv-LXC writes break)

User's Nextcloud rollout already hit the classic trap of unprivileged-LXC
write attempts against an NFS share, so don't repeat that pattern for
Nexa. Updated docs to:

- Use SMB volumes mounted directly as docker volumes (driver: local,
  type: cifs) with explicit username/uid/gid — bypasses LXC uid-mapping
  entirely. Concrete YAML in docs/09 step 3 against
  //192.168.1.31/nexa/<volume>.
- Keep the host-side /mnt/pve/unas NFS mount for admin-only use (rsync,
  manual snapshot copies). Don't bind-mount it into containers.
- docs/12 #27 reordered to lead with SMB targets (qdrant, graphdb,
  tei-cache, snapshots) and only mention NFS for host admin.
- CLAUDE.md storage block flipped to "SMB = default per-container
  storage; NFS = host-side admin only".
- Also captured: deployments go through the Dockge UI (LXC is
  the Dockge flavor of helper-scripts), not raw `docker compose up`.
- New optimization #30 about the local mail spool nag on the docker LXC
  ("You have new mail." at login).

docs/09-deployment.md

@@ -92,17 +92,43 @@ This means **no data is lost** between 3.1 and 3.2 — the queue is the GraphDB
 
 Use HuggingFace **text-embeddings-inference** — single Rust binary, ~500 MB image, OpenAI-compatible API, loads exactly one model. Lighter than Ollama because there's no LLM runtime, no GGUF loader, no model registry.
 
-```bash
-# on the docker host (LXC 104)
-docker run -d --name nexa-embed \
-  --restart unless-stopped \
-  -p 127.0.0.1:8080:80 \
-  -v tei-data:/data \
-  ghcr.io/huggingface/text-embeddings-inference:cpu-1.5 \
-  --model-id BAAI/bge-m3
+The docker LXC is the **Dockge** flavor of `proxmox-helper-scripts` — paste the stack into the Dockge UI (`http://192.168.1.40:5001` or whatever Zoraxy host is configured), name it `nexa`, save, start. Don't `docker compose up -d` over SSH; Dockge maintains the compose YAML at `/opt/stacks/nexa/compose.yaml`.
+
+```yaml
+# Dockge stack: nexa (paste in the UI)
+services:
+  nexa-embed:
+    image: ghcr.io/huggingface/text-embeddings-inference:cpu-1.5
+    container_name: nexa-embed
+    restart: unless-stopped
+    command: ["--model-id", "BAAI/bge-m3"]
+    ports:
+      - "127.0.0.1:8080:80"
+    volumes:
+      - tei-cache:/data
+
+volumes:
+  # SMB volume on UNAS — sidesteps NFS+unprivileged-LXC permission issues
+  # (the same kind that bit the Nextcloud rollout). Stores embedding model
+  # caches, Qdrant snapshots, future GraphDB exports.
+  tei-cache:
+    driver: local
+    driver_opts:
+      type: cifs
+      device: //192.168.1.31/nexa/tei-cache
+      o: "username=${UNAS_USER},password=${UNAS_PASS},uid=1000,gid=1000,vers=3.0,iocharset=utf8"
+
+networks:
+  default:
+    external: true
+    name: nexa
 ```
 
-Memory budget: ~1.1 GB resident (bge-m3 is ~1 GB + ~100 MB overhead). First start downloads the model into the named volume; subsequent restarts are instant.
+Memory budget: ~1.1 GB resident. First start downloads `bge-m3` (~1 GB) into the SMB-backed volume; subsequent restarts are instant.
+
+> **Why SMB and not the Proxmox `/mnt/pve/unas` NFS mount?** The host-side NFS mount works fine for host admin, but **unprivileged LXC + NFS + per-container writes** historically breaks (user confirmed: "had it with Nextcloud"). Mounting SMB **directly as a docker volume** with explicit `username=`/`uid=`/`gid=` bypasses LXC uid-mapping entirely — the docker daemon is root inside the LXC so it can mount, and the container sees a regular volume with the right ownership.
+>
+> Add `UNAS_USER` / `UNAS_PASS` to the Dockge stack's `.env`, or — better — store them in Vaultwarden and inject via a secrets agent (see [12/#13](./12-optimization-opportunities.md)).
 
 Register it inside LiteLLM (admin UI → Models) with the OpenAI-compatible adapter: