db as source of truth: wiki→seeds, archive old artifacts, knowledge ingestion

- Migrations 010 (content_hash) + 011 (search tsvector column)
- new: internal/knowledge/seed.go — knowledge seed ingest engine
- new: internal/httpapi/knowledge.go — SearchKnowledge + GetEntityKnowledge
- wire knowledge ingest into oikos seed pipeline
- convert all 36 wiki docs + 6 investigations + 12 runbooks → seeds/knowledge.yaml
- archive: knowledge/wiki/→archive/, oikos/cards/→archive/, .hermes/plans/→archive/
- delete: 9 superseded Python kernel files, ledger/, mcp/build_host_files.py
- remove empty knowledge/ directory tree

archive/knowledge/containers/131-teddycloud.md

@@ -0,0 +1,62 @@
+# 131 — `teddycloud`
+
+Self-hosted [TeddyCloud](https://github.com/toniebox-reverse-engineering/teddycloud), a
+reimplementation of the Toniebox cloud backend — lets Tonie figurines play custom/ripped
+audio content against a local server instead of the official cloud.
+
+Predates the client-enrollment convention entirely; nobody wrote it down. Found and
+documented on 2026-07-06 after Oikos's drift detector (`oikos/drift.py`) flagged
+`pve_id 131` as live on hubris (via `pct list`) with no `inventory.yaml` entry — see
+[OIKOS.md](../../../.agents/OIKOS.md)'s Week 3 build-status note. `containers/132-rclone.md` had already
+mentioned it in passing ("LXC 131 was already taken by an undocumented `teddycloud`
+container"), and `hosts/strong.md`'s 2026-07-05 migration changelog fixed a DHCP conflict
+for it — but it never got its own inventory entry or doc page until now.
+
+## At a glance
+
+- **Hostname:** `teddycloud`
+- **Host:** hubris (confirmed via `pct config 131` run directly on hubris — the original
+  drift finding's `pct list` source)
+- **IP:** `192.168.8.150` (static; was briefly `192.168.8.243` via DHCP until the
+  2026-07-05 strong-migration work assigned it a fixed address — see hosts/strong.md)
+- **Privilege:** unconfirmed (not checked — read-only investigation didn't need it)
+- **Resources:** 1 core / 1 GiB RAM / 512 MiB swap / 16 GiB rootfs (`local-lvm`), Debian 12
+  (bookworm)
+- **Mounts:** `/mnt/library` (`mp0`)
+- **Public hostname:** `teddy.hubris.network` → `192.168.8.150:8443` (see
+  [caddy (121)](121-caddy.md))
+- **Enrollment:** none — no `age_pubkey`, not a `homelab` CLI client. It's a plain
+  docker-compose app container, not a fleet-managed host. No action needed unless it starts
+  needing secrets.
+
+## Service
+
+Runs via `docker compose` at `/opt/teddycloud` — container `teddycloud-teddycloud-1`,
+image `ghcr.io/toniebox-reverse-engineering/teddycloud:latest`, publishing `80`, `443`,
+`8080`, and `8443`. Caddy routes `teddy.hubris.network` to the `:8443` port.
+
+## Risk notes
+
+**No Caddy forward-auth gate** — unlike `sab.hubris.network` on the same Caddyfile (which
+is explicitly annotated `(Authentik forward-auth)`), `teddy.hubris.network` has no auth
+annotation. It's reachable to anyone on the LAN/mesh who can resolve the hostname. Not
+addressed as part of this doc pass — flagging it here since it's now visible in one place
+for the first time.
+
+## Related
+
+- [Hubris host](../hosts/hubris.md)
+- [Caddy (121)](121-caddy.md) — terminates `teddy.hubris.network`
+- [rclone (132)](132-rclone.md) — landed on pve_id 132 specifically because 131 was already
+  taken by this container
+- [Containers index](index.md)
+- [OIKOS.md](../../../.agents/OIKOS.md) — drift detector that caught this
+
+## Changelog
+
+### 2026-07-06 — documented for the first time (drift-caught)
+
+Added to `inventory.yaml` and given this page. Verified live via read-only `pct config 131`
++ `pct exec 131 -- ...` on hubris: hostname, IP, resources, and that it runs via
+`docker compose` (not a raw binary or systemd unit). No changes made to the running
+container — this is pure documentation catch-up.