Resolve Q4/Q5/Q13/Q14/Q18: Obsidian via Nextcloud WebDAV, Karakeep, Octoprint suppress

- Q4 → Obsidian vault is the Notizen/ folder in Nextcloud (multi-device sync).
  Nexa reads via WebDAV using the existing NC_APP_PASSWORD — no filesystem
  mount. Ignore list pinned: .copilot/, .copilot-index/, .smart-env/,
  .caldav-sync/, assets/ (routed to Phase-3.2 visual queue), Templates/,
  BMO/, Excalidraw/. Index target: Notizen/**/*.md.
- Q5 → canonical name is Karakeep; legacy Zoraxy alias hoarder.nuclide.systems
  kept for compatibility.
- Q13 → Octoprint container is intentionally powered down most of the time.
  Phase-5 monitoring must skip names matching octoprint*. Reflected in
  docs/10 monitoring table and CLAUDE.md.
- Q14 → Homepage Zoraxy widget config error; cosmetic, dropped from open
  questions and from docs/12 optimization list.
- Q18 → SAIA does proxy embeddings but rate limit is 10 msg/min, unusable
  for ingest. TEI stays in Phase 3.1.
- docs/12: stale items removed (Octoprint, Zoraxy widget, generic Immich
  vector idea); added new ones derived from the Obsidian discovery (plugin
  embedding collision, notify_push upgrade path, assets/ size note).
- docs/04 integration matrix updated to describe Obsidian-via-Nextcloud
  read path explicitly.
- docs/09 step-4 credentials list collapses NC Tasks / Calendar / WebDAV
  onto a single app password.

docs/09-deployment.md

@@ -13,7 +13,7 @@ Surveyed from Homepage / Dozzle / Proxmox / Zoraxy:
 | LiteLLM (SAIA gateway) | docker LXC 104 → `:4000` | `https://ai.nuclide.systems` (proxies LobeHub UI :3210; API on :4000) |
 | Nextcloud | LXC 105 | `https://nc.nuclide.systems` |
 | ntfy | docker LXC 104 → `:7998` | `https://ntfy.nuclide.systems` |
-| Karakeep (Hoarder) | docker LXC 104 → `:3090` | `https://hoarder.nuclide.systems` |
+| Karakeep | docker LXC 104 → `:3090` | `https://hoarder.nuclide.systems` (legacy host alias kept for compatibility) |
 | Home Assistant | VM 100 (HAOS) | `https://ha.nuclide.systems` |
 | Pocket-ID (OAuth/SSO) | docker LXC 104 → `:1411` | `https://id.nuclide.systems` |
 | Vaultwarden | docker LXC 104 → `:11001` | `https://vault.nuclide.systems` |
@@ -145,8 +145,8 @@ done
 Inside n8n, attach credentials to the imported nodes:
 
 - **Memos** → HTTP header `Authorization: Bearer $MEMOS_API_KEY`
-- **LiteLLM** → header `Authorization: Bearer $SAIA_API_KEY`
-- **Nextcloud** → app password
+- **LiteLLM** → header `Authorization: Bearer $SAIA_API_KEY` (chat + `nexa-embed`)
+- **Nextcloud Tasks / Calendar / WebDAV (Obsidian vault under `Notizen/`)** → one app password (`$NC_APP_PASSWORD`), reused across all three node types
 - **Qdrant** → header `api-key: $QDRANT_API_KEY`
 
 Activate each workflow individually after smoke-test.