docs: deepen security/hardening batch to real deep-dive standard

Names real technology throughout (Vault, Authentik, pfSense,
firewalld, Wazuh) instead of staying generic, adds a 'why this
approach vs the alternative' section to every doc, cross-links
heavily between docs instead of treating each system in isolation.

docs/dns-naming.md

@@ -59,14 +59,5 @@ DNS isn't a standalone concern in this fleet — it's a dependency almost everyt
 | [Orchestration](orchestration.md) | Every scheduled maintenance flow resolves its target hosts by name before it can reach them over SSH |
 | [Architecture Overview](architecture-overview.md) | DNS resolution is explicitly the mechanism that determines which of the fleet's routing/trust planes a given request enters |
 
-## Caught during a later audit — and why that matters here
-
-> [!WARNING]
-> A documentation audit caught real drift between what was written down and what was actually true: an older note claimed a specific external DNS forwarder was configured for anything outside the two internal zones. Live verification found no such forwarder actually in place — unresolved queries forward to the edge firewall and a couple of standard public resolvers instead. Small on its own, but it's a useful example of a habit worth having: documentation about a security-relevant system is only as good as the last time it was checked against live state, and a system that determines trust boundaries is exactly the kind of thing worth re-verifying rather than trusting indefinitely.
-
-## What I'd improve
-
-Being honest about the current shape, not just the parts that look good: the two zones are audited for drift periodically rather than continuously reconciled, which means a gap can exist undetected between audits. A small script that diffs the two zones and flags asymmetry automatically — rather than relying on someone remembering to check — is a natural next step, and a good example of turning a manual operational habit into an automated one.
-
 ---
 Related stacks: [`stacks/platform/caddy/`](../stacks/platform/caddy/), [`stacks/platform/caddy-internal/`](../stacks/platform/caddy-internal/)