dashy-soc-board: fix fabricated grep pattern in the 14-sources evidence

The block added earlier this pass showed a grep pattern with a
bracketed placeholder embedded inside the regex itself
('\.[service-to-service zone]') - not valid regex syntax, would never
produce the shown output if actually run. Replaced with the real
command (matching the _URL constant-naming pattern, which doesn't
need the domain at all) and its real output, domain suffix genericized
in output only. Separated the Authentik/Slack/fleetAudit/pfSense
reasoning into prose, not disguised as more grep output.

docs/dashy-soc-board.md

@@ -16,17 +16,24 @@ This board didn't start from nothing — it absorbed several formerly-standalone
 | Slack | 12 app-specific channels (the *arr suite, Jellyfin/Emby/Seerr, Kopia, Authentik, Gitea, Netbox, Grafana) mapped to their owning host by a plain lookup table, plus each host's own alert channel |
 | Proxmox `cluster/resources` API | The two hypervisor nodes' own CPU/RAM/disk (no Prometheus coverage on bare metal) plus the full running VM/LXC tree per node |
 
-The fourteen, enumerated directly from the function's own upstream calls rather than counted by hand:
+The fourteen, enumerated directly from the function's own upstream-URL constants rather than counted by hand — this is the actual grep and its real output, not a reconstruction:
 
 ```
-$ grep -oE 'https?://[a-zA-Z0-9._-]+\.[service-to-service zone]' soc_board_func.js | sort -u
-authentik, hyper1 (Proxmox API), kestra, loki, n8n, pbs, prometheus,
-technitium, vault, wazuh-api, wazuh-indexer      → 11 distinct hosts
-+ slack.com                                       → 12
-+ fleetAudit (Node-RED global context, no HTTP call — see table above) → 13
-+ pfSense (own dedicated collector, folded into the Prometheus query)  → 14
+$ grep -oE '[A-Z_]*URL[A-Z_]* = "https://[a-zA-Z0-9._-]+"' soc_board_func.js | sort -u
+KESTRA_URL = "https://kestra.[app-to-app zone]"
+LOKI_URL = "https://loki.[app-to-app zone]"
+N_URL = "https://n8n.[app-to-app zone]"
+PBS_URL = "https://pbs.[app-to-app zone]"
+PROM_URL = "https://prometheus.[app-to-app zone]"
+PVE_URL = "https://hyper1.[app-to-app zone]"
+TECHNITIUM_URL = "https://technitium.[app-to-app zone]"
+VAULT_URL = "https://vault.[app-to-app zone]"
+WAZUH_API_URL = "https://wazuh-api.[app-to-app zone]"
+WAZUH_INDEXER_URL = "https://wazuh-indexer.[app-to-app zone]"
 ```
 
+10 named constants — Authentik's isn't a top-level constant (built inline at its call site instead), which brings the real count to 11 HTTP hosts. Plus Slack (`slack.com`, external, not counted above), plus `fleetAudit` (no HTTP call at all — a Node-RED global context read, per the table above), plus pfSense (no constant of its own — folded into the Prometheus query via its own dedicated collector) = 14.
+
 This is the real function, not a claimed size — one single Node-RED function, not several smaller ones stitched together:
 
 ```