Add Miniflux to the sensitive tier

[Gerrrt]

Beyond ADR-0008's nine.

What and why

Miniflux Apache-2.0 Go/deb/Docker — awesome-selfhosted README.md:869.

A single Go binary feed reader, around 30 MB resident. No JavaScript framework, no plugin system, and a deliberately fixed feature set. It also speaks the Google Reader and Fever APIs, so third-party mobile clients work against it.

FreshRSS (:863, AGPL-3.0, PHP/Docker) is the alternative — fuller UI, more extensible, PHP and a web server to keep patched. Either is defensible; Miniflux is the pick because a feed reader is a background service and the smallest one that works is the correct one.

Placement

Sensitive tier, VLAN 99. A subscription list is a reasonable proxy for what someone reads and cares about, which puts it closer to the bookmark collection (#144) than to the film library.

Note this is one of the few services here that reaches outward on a schedule — it polls feeds continuously. That is unremarkable for a segment with egress, but it is worth knowing which services generate steady outbound traffic when reading the network dashboard, and this is one.

What it needs

• The mini PC from ADR-0008: the sensitive-tier services and two new firewall rules are untracked #102 and Caddy (Sensitive tier: Caddy as the reverse proxy and the only published port #129).
• Postgres — it does not support SQLite, which is its one real dependency.
• Admin credentials and the database password in secrets/*.sops.yaml.

Which VLAN this touches

🔴 99 — Winterfell (management)

Security review

• Does not weaken the default-deny posture between VLANs — reached from Hicks under the existing 50→99; no new rule
• Any new credential goes in secrets/*.sops.yaml
• Any new device is added to docs/network.md with an OUI-truncated MAC — n/a

Depends on

#102 (the mini PC), #129 (Caddy).