Document teddycloud (pve_id 131) — closes the Week-3 drift finding

teddycloud was live on hubris (LXC 131, docker compose, TeddyCloud —
a Toniebox cloud reimplementation) but never made it into inventory.yaml.
Already referenced in passing by containers/132-rclone.md ("131 was
already taken by an undocumented teddycloud container") and
hosts/strong.md's migration changelog (a DHCP conflict fix), but no
inventory entry or doc page existed until oikos/drift.py's inventory-
vs-live check caught it.

Verified live via read-only SSH (pct config 131, pct exec 131 -- ...,
docker ps): hostname, static IP 192.168.8.150, 1 core/1GiB/16GiB rootfs,
Debian 12, runs via docker compose at /opt/teddycloud. No changes made
to the running container.

Also fixed: house's inventory notes claimed 192.168.8.212 is teddycloud's
current IP via DHCP — stale, teddycloud has a static IP now.

Flagged in the new container page: teddycloud has no Caddy forward-auth
gate, unlike sab.hubris.network on the same Caddyfile.

`python3 oikos/drift.py` no longer reports an inventory-vs-live finding
for pve_id 131. (A separate, pre-existing gap surfaced while verifying
this: rclone's own inventory.yaml block is missing pve_id/host/lan_ip —
out of scope here, flagging for a follow-up.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hosts/house.yaml

@@ -19,7 +19,8 @@ notes:
 - Docker host for Yuvomi (family planner). Created 2026-06-26.
 - Migrated from hubris to strong 2026-07-05 (Phase 1 of strong migration plan).
 - Runs Yuvomi container + WebDAV doc bridge to paperless
-- 192.168.8.212 was the hubris IP before migration (now used by teddycloud via DHCP)
+- 192.168.8.212 was the hubris IP before migration (briefly picked up by teddycloud via DHCP; teddycloud
+  has since been given a static IP, see hosts.teddycloud)
 age_pubkey: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
 see_also:
 - containers/129-house.md

hosts/teddycloud.yaml

@@ -0,0 +1,44 @@
+# Generated by mcp/build_host_files.py from inventory.yaml.
+# Do NOT edit by hand — your changes will be overwritten.
+# Source of truth: ../inventory.yaml
+name: teddycloud
+kind: lxc
+os: linux
+role: teddycloud
+state: active
+host: hubris
+pve_id: 131
+lan_ip: 192.168.8.150
+mesh_globals:
+  primary: netbird
+  accepted:
+  - netbird
+  - tailscale
+mounts:
+- /mnt/library
+public_host: teddy.hubris.network
+runs:
+- teddycloud
+services_hosted:
+- name: teddycloud
+  url: https://teddy.hubris.network
+  backend: teddycloud
+  doc_page: containers/131-teddycloud.md
+  note: self-hosted TeddyCloud (Toniebox cloud reimplementation), docker compose
+  risk_notes: "no Caddy forward-auth gate (unlike sab.hubris.network on the same Caddyfile) \u2014 reachable\
+    \ to anyone on the LAN/mesh who can resolve teddy.hubris.network; undocumented in inventory.yaml until\
+    \ 2026-07-06 (drift-caught)"
+notes:
+- Docker host for TeddyCloud (ghcr.io/toniebox-reverse-engineering/teddycloud), a self-hosted reimplementation
+  of the Toniebox cloud backend. Debian 12 (bookworm).
+- 1 core / 1 GiB RAM / 512 MiB swap / 16 GiB rootfs (local-lvm).
+- "Predates the client-enrollment convention \u2014 undocumented in inventory.yaml until 2026-07-06, when\
+  \ Oikos's drift detector (oikos/drift.py) caught pve_id 131 live on hubris (`pct list`) with no inventory\
+  \ entry. Static IP assigned 2026-07-05 during the strong migration (was picking up 192.168.8.243 via\
+  \ DHCP before that \u2014 see hosts/strong.md's 2026-07-05 changelog)."
+- "No age_pubkey / homelab-context enrollment \u2014 not a homelab CLI client, just a docker-compose app\
+  \ container. Not a required follow-up unless it needs secrets."
+see_also:
+- containers/131-teddycloud.md
+mcp_endpoint: https://mcp.hubris.network/mcp
+secrets_issuance_endpoint: https://secrets.hubris.network/issue