Document teddycloud (pve_id 131) — closes the Week-3 drift finding

teddycloud was live on hubris (LXC 131, docker compose, TeddyCloud —
a Toniebox cloud reimplementation) but never made it into inventory.yaml.
Already referenced in passing by containers/132-rclone.md ("131 was
already taken by an undocumented teddycloud container") and
hosts/strong.md's migration changelog (a DHCP conflict fix), but no
inventory entry or doc page existed until oikos/drift.py's inventory-
vs-live check caught it.

Verified live via read-only SSH (pct config 131, pct exec 131 -- ...,
docker ps): hostname, static IP 192.168.8.150, 1 core/1GiB/16GiB rootfs,
Debian 12, runs via docker compose at /opt/teddycloud. No changes made
to the running container.

Also fixed: house's inventory notes claimed 192.168.8.212 is teddycloud's
current IP via DHCP — stale, teddycloud has a static IP now.

Flagged in the new container page: teddycloud has no Caddy forward-auth
gate, unlike sab.hubris.network on the same Caddyfile.

`python3 oikos/drift.py` no longer reports an inventory-vs-live finding
for pve_id 131. (A separate, pre-existing gap surfaced while verifying
this: rclone's own inventory.yaml block is missing pve_id/host/lan_ip —
out of scope here, flagging for a follow-up.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

inventory.yaml

@@ -124,6 +124,14 @@ services:
   haos:
     backend: haos
     doc_page: vms/108-haos.md
+  teddycloud:
+    url: https://teddy.hubris.network
+    backend: teddycloud
+    doc_page: containers/131-teddycloud.md
+    note: self-hosted TeddyCloud (Toniebox cloud reimplementation), docker compose
+    risk_notes: no Caddy forward-auth gate (unlike sab.hubris.network on the same Caddyfile) —
+      reachable to anyone on the LAN/mesh who can resolve teddy.hubris.network; undocumented
+      in inventory.yaml until 2026-07-06 (drift-caught)
   homelab_mcp:
     backend: apps
     port: 9810
@@ -185,7 +193,8 @@ hosts:
     - Docker host for Yuvomi (family planner). Created 2026-06-26.
     - Migrated from hubris to strong 2026-07-05 (Phase 1 of strong migration plan).
     - Runs Yuvomi container + WebDAV doc bridge to paperless
-    - 192.168.8.212 was the hubris IP before migration (now used by teddycloud via DHCP)
+    - 192.168.8.212 was the hubris IP before migration (briefly picked up by teddycloud via
+      DHCP; teddycloud has since been given a static IP, see hosts.teddycloud)
     age_pubkey: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
   jellyfin:
     kind: lxc
@@ -387,6 +396,28 @@ hosts:
     - Docker host for Grimmory (community fork of Booklore). Created 2026-06-29.
     - Migrated from hubris to strong 2026-07-05 (Phase 2d). Books on ludo-lvm.
     age_pubkey: age1uellsemnjrzgfg9fxw4jefpy05laxzggwnwhh6ny3wl7alyp6v8q0muxet
+  teddycloud:
+    kind: lxc
+    pve_id: 131
+    host: hubris
+    os: linux
+    role: teddycloud
+    lan_ip: 192.168.8.150
+    public_host: teddy.hubris.network
+    mounts:
+    - /mnt/library
+    state: active
+    notes:
+    - Docker host for TeddyCloud (ghcr.io/toniebox-reverse-engineering/teddycloud), a
+      self-hosted reimplementation of the Toniebox cloud backend. Debian 12 (bookworm).
+    - 1 core / 1 GiB RAM / 512 MiB swap / 16 GiB rootfs (local-lvm).
+    - Predates the client-enrollment convention — undocumented in inventory.yaml until
+      2026-07-06, when Oikos's drift detector (oikos/drift.py) caught pve_id 131 live on
+      hubris (`pct list`) with no inventory entry. Static IP assigned 2026-07-05 during the
+      strong migration (was picking up 192.168.8.243 via DHCP before that — see
+      hosts/strong.md's 2026-07-05 changelog).
+    - No age_pubkey / homelab-context enrollment — not a homelab CLI client, just a
+      docker-compose app container. Not a required follow-up unless it needs secrets.
   seanime:
     kind: lxc
     pve_id: 133