feat: scaffold Brain of Reese — FastAPI RAG chat over Postgres 17 + pgvector

Foundation (phase 01, verified):
- FastAPI app: /api/health, /api/suggestions, /api/chat (placeholder),
  static frontend served locally (no CDN)
- Postgres 17 + pgvector via db/Containerfile + compose.yaml
  (podman compose up -d db), Alembic initial migration (documents,
  chunks with vector(768), query_log)
- LLM client targeting https://aipi.reeseapps.com/v1 (turbo/embed);
  scripts/llm_probe.py verified models + 768-dim embeddings live
- Conditional debugpy: imported only when DEBUGPY=1 (attach on demand,
  :5678); logging config for clean single-line logs
- Frontend shell: mobile-first chat + Sources pages, tokens, a11y baselines
- Tests: 24 unit+integration (99% coverage on app/), ruff + pyright clean,
  Playwright smoke E2E (3 tests) against a deterministic mock LLM
- Planning: .agent/PLAN.md (architecture + LOCKED decisions), AGENTS.md,
  6 user stories, 7 phase files (one story / one phase / one Playwright
  suite each)

tests/fixtures/docs/deployments/new-service.md

@@ -0,0 +1,13 @@
+# Deploying a New Service
+
+## Steps
+1. Fork the `template/` repository.
+2. Add a cloud-init snippet for provisioning the host.
+3. Wire up the reverse proxy (Traefik) with a `reeseapps.com` label.
+4. Run the Ansible play: `ansible-playbook sites.yaml -l newhost`.
+
+## Domains
+All public services live under `*.reeseapps.com`.
+
+## DNS
+Managed by the ddns updater; new subdomains appear within an hour.

tests/fixtures/docs/homelab/backups.md

@@ -0,0 +1,14 @@
+# Backup Strategy
+
+## Philosophy
+3-2-1 rule: three copies, two media types, one offsite.
+
+## Tooling
+BorgBase for offsite backups. Restic for local nightly snapshots, orchestrated via Ansible.
+
+## Schedule
+- Nightly 02:00 — restic local snapshots
+- Weekly Sunday 03:00 — borg offsite push
+
+## Restore
+Restores are documented per-service in each deployment README. Test a restore quarterly.

tests/fixtures/docs/homelab/kubernetes.md

@@ -0,0 +1,16 @@
+# Kubernetes Homelab Cluster
+
+## Overview
+The cluster runs Talos Linux on three nodes: two workers (i5-8500, 32GB) and one control plane.
+
+## Networking
+Cilium handles networking and the L4/L7 proxy. Ingress is served via the Cilium Gateway API.
+
+## Storage
+Local-path-provisioner provides scratch storage. Longhorn is intentionally not used.
+
+## Notable Workloads
+- Gitea (source control)
+- ntfy (push notifications)
+- Homepage (dashboard)
+- Uptime Kuma (monitoring)