Add Stirling-PDF to the sensitive tier

[Gerrrt]

Beyond ADR-0008's nine. Pairs directly with Paperless-ngx (#133).

What and why

Stirling-PDF Apache-2.0 Docker/Java — awesome-selfhosted README.md:762.

Merge, split, rotate, convert, OCR, sign, compress — the operations that otherwise get done by uploading a document to whichever free PDF website ranks first that week.

That last point is the actual argument. This estate segments its network by trust and encrypts its secrets at rest, and none of it matters if a P60 or a passport scan goes through an anonymous web converter on the way to being emailed. This is a small service that closes a real gap between the household's habits and the design's intent.

Paperless (#133) is an archive and deliberately not an editor; Stirling is the editor and deliberately not an archive. Neither wants to be the other.

Placement

Sensitive tier, VLAN 99 — it handles the same documents Paperless holds, so it inherits the same classification. Processing is entirely local; nothing leaves the container.

What it needs

• The mini PC from ADR-0008: the sensitive-tier services and two new firewall rules are untracked #102 and Caddy (Sensitive tier: Caddy as the reverse proxy and the only published port #129).
• A memory limit — it is JVM-based and will use what it is given (Set memory limits on the six services to bound the blast radius of a leak #114, No resource limits on any container, and no size bound on retention #71).
• No credentials of its own by default. Enabling its login is worth doing anyway rather than relying on network position alone.
• Uploaded files are transient; check the temp-file cleanup setting, because a stack of half-processed financial documents in a container volume is its own small problem.

Which VLAN this touches

🔴 99 — Winterfell (management)

Security review

• Does not weaken the default-deny posture between VLANs — reached from Hicks under the existing 50→99; no new rule
• Any new credential goes in secrets/*.sops.yaml — if login is enabled
• Any new device is added to docs/network.md with an OUI-truncated MAC — n/a

Depends on

#102 (the mini PC), #129 (Caddy). Pairs with #133.