Document verified odin access path and Unraid API

Replace the assumed/unconfirmed environment notes with facts verified from
this box, and add docs/odin-access.md as the access reference.

Verified:
- Tailscale is the only path from dev to odin. dev (100.94.16.46) is a VPS
  with a public IP, not a LAN machine; odin is 100.101.253.105, and a subnet
  route puts 192.168.90.0/24 over tailscale0 at the same ~34ms RTT.
- The myunraid.net host is the canonical nginx vhost, not a cloud relay --
  DNS resolves it to the private 192.168.90.103, so traffic stays on the
  tailnet. The bare IP 404s on /graphql, and plain HTTP 302-redirects to the
  myunraid host while stripping the x-api-key header.
- GraphQL is live: unauthenticated POSTs return HTTP 200 with an
  UNAUTHENTICATED error body, so 200 must never be read as success.

Corrects unraid-docker-manager's claim that no SSL ignore is needed: TLS
verification fails from dev because ca-certificates 20250419 cannot chain
Let's Encrypt intermediate YR1. The cert is genuine and the claim likely
holds on odin itself, but curl needs -k here.

Container-polling field behaviours (UPPERCASE state, /-prefixed names,
PrefixedID ids, no isUpdateAvailable in 7.2) are carried over from
unraid-docker-manager, which is credited as the authoritative source.

No API key is present on this box; .env.unraid-api is gitignored there and
absent from the clone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -43,13 +43,13 @@ Copy `_template/` to the new name, fill in its README, and add one line to the r
 
 ## The environment
 
-> **⚠ Confirm the gaps marked `?` below, then delete this warning.** The infrastructure
-> facts are carried over from the FamilySync project, where they are documented and
-> verified. Only the mapping of the *name* `odin` to that host is assumed — the name
-> appears in no memory, transcript, or config on this box.
+**odin** — the Unraid server; the single host everything self-hosted runs on. Reached from
+this box over **Tailscale** (`100.101.253.105`, LAN `192.168.90.103`).
 
-**odin** — the Unraid server; the single host everything self-hosted runs on. Verified
-characteristics:
+> **See [docs/odin-access.md](docs/odin-access.md)** for the access path, the WebGUI/API
+> endpoint, TLS caveats, and the Unraid GraphQL API — all verified from this box.
+
+Verified characteristics:
 
 | Aspect | Detail |
 | --- | --- |
@@ -60,9 +60,12 @@ characteristics:
 | Auth | Authelia — OIDC/OAuth2 provider for internal apps |
 | Ingress | Pangolin/Newt tunnel — **no open inbound ports** |
 | DNS | Split-DNS on `bergerhouse.net`; private IPs resolve internally |
-| Git forge | Self-hosted Gitea/Forgejo at `git.bergerhouse.net` (user `luckberg`) |
+| Git forge | Self-hosted Gitea/Forgejo at `git.bergerhouse.net` (user `luckberg`, SSH port 222) |
 | CI | Gitea Actions with a self-hosted runner |
 | Mail / calendar | Fastmail (paid) — JMAP/CalDAV, the source of truth for calendars |
+| Remote access | Tailscale; odin `100.101.253.105`, subnet route for `192.168.90.0/24` |
+| Unraid API | GraphQL at `{myunraid.net host}:8443/graphql`, `x-api-key` auth (Unraid 7.2+) |
+| Automation | n8n on odin — drives the Docker-manager Telegram bot |
 
 Known service hostnames: `git.bergerhouse.net`, `familysync.bergerhouse.net`,
 `familysync-dev.bergerhouse.net`.
@@ -72,14 +75,26 @@ PostgreSQL, any cloud provider.
 
 ### This box vs. odin
 
-The machine this repo is edited on is `dev` — a **separate workstation**, not the server.
-Scripts written here usually *target* odin (over SSH, or by being deployed into a
-container/user-script on it). Never assume a script runs on the same host it was authored
-on: take the target as a parameter or read it from config.
+The machine this repo is edited on is `dev` (Tailscale `100.94.16.46`) — a **separate
+workstation**, and in fact a VPS with a public IP, not a machine on the home LAN. Scripts
+written here usually *target* odin. Never assume a script runs on the same host it was
+authored on: take the target as a parameter or read it from config.
 
-`?` — SSH access method to odin (no `~/.ssh/config` entry exists on this box yet), and
+Tailscale is the **only** path from `dev` to odin — if it is down, nothing below resolves.
+
+`?` — still unconfirmed: the SSH login to odin (no `~/.ssh/config` entry on this box) and
 where deployed scripts are expected to live on the Unraid host.
 
+### Sibling repos on `git.bergerhouse.net`
+
+`luckberg/` holds `scripts` (this repo), `familysync`, `unraid-docker-manager`,
+`azure-epac`, `_cargo-index`. Two are load-bearing context:
+
+- **`unraid-docker-manager`** — n8n + Telegram bot managing odin's containers. The
+  authoritative source on the Unraid GraphQL API and container polling; distilled into
+  [docs/odin-access.md](docs/odin-access.md).
+- **`familysync`** — the origin of most of the stack facts in the table above.
+
 ---
 
 ## Prior context: MemPalace