Add linkding to the sensitive tier

[Gerrrt]

Beyond ADR-0008's nine.

What and why

linkding MIT Docker — awesome-selfhosted README.md:303.

Bookmark management. Small, fast, SQLite-backed, with browser extensions and a REST API. It does one thing and stops, which is why it is the pick over the heavier options.

Karakeep (:301, AGPL-3.0) is the alternative — full-text archival of page content plus AI tagging, at several times the footprint and with a model runtime to feed. Wallabag (:187, MIT) sits between them, focused on readable article archival rather than bookmarks.

Start with linkding. If the want turns out to be "the page still exists when the site is gone" rather than "I can find the link again", that is a different service and worth reopening then.

Placement

Sensitive tier, VLAN 99. A bookmark collection is a browsing history by another name — modest on its own, revealing in aggregate, and not something to put on a segment shared with the televisions.

What it needs

• The mini PC from ADR-0008: the sensitive-tier services and two new firewall rules are untracked #102 and Caddy (Sensitive tier: Caddy as the reverse proxy and the only published port #129).
• Superuser credentials in secrets/*.sops.yaml.
• Very little else — this is one of the smallest services on the shortlist.

Which VLAN this touches

🔴 99 — Winterfell (management)

Security review

• Does not weaken the default-deny posture between VLANs — reached from Hicks under the existing 50→99; no new rule
• Any new credential goes in secrets/*.sops.yaml
• Any new device is added to docs/network.md with an OUI-truncated MAC — n/a

Depends on

#102 (the mini PC), #129 (Caddy).