README: ground every Systems bullet in verified, sourced detail

Fixed one real inaccuracy (Gitea registry scope, Secret Distribution
path count) and replaced generic descriptions with true, specific
detail across all 14 Systems bullets - real incidents, real design
decisions, concrete numbers - each checked against Trilium and, where
relevant, the live Ansible roles rather than trusted at face value.

Also stages a verified-but-unintegrated PAM hardening finding in
docs/firewall-and-network.md for that file's own upcoming audit pass.

docs/firewall-and-network.md

@@ -61,5 +61,8 @@ The second reverse-proxy layer here is genuinely separate from the internal two-
 
 Proxmox has its own built-in firewall capability, left with an empty ruleset on purpose. pfSense and firewalld already cover the two layers that matter — public/internal segmentation and per-host minimal exposure — and a third overlapping layer at the hypervisor level would add complexity (a third ruleset to audit, a third place a rule could silently be wrong) without meaningfully improving posture. Recognizing when *not* to add a redundant control is as much a design decision as adding one, and it's the same reasoning that kept the secrets model in [`docs/secrets-and-pki.md`](secrets-and-pki.md) to one trust root instead of two.
 
+> [!NOTE]
+> **Staged for this file's full audit pass — verified true, not yet integrated into the prose above.** Confirmed directly against the live Ansible role, not just against documentation: on the fleet's Debian-family hosts, the PAM login stack is deliberately configured to stop immediately on a successful authentication instead of jumping to a numbered step — a defense against a future package silently inserting its own PAM line and shifting that jump target, which would misread a correct password as a failed one. Not theoretical: exactly that bug was caught live on one of those hosts before this fix went in. Rocky/RHEL-family hosts don't need the same fix — they manage their PAM stack through `authselect`, a different, declarative system not exposed to the same class of ordering bug. Fold this in wherever it fits once this file gets its real pass — likely near "Per-host firewalls" above, as another example of defense-in-depth below the network layer.
+
 ---
 Related: [`docs/dns-naming.md`](dns-naming.md), [`docs/architecture-overview.md`](architecture-overview.md), [`docs/security-monitoring.md`](security-monitoring.md) · Stacks: [`stacks/platform/caddy/`](../stacks/platform/caddy/), [`stacks/platform/caddy-internal/`](../stacks/platform/caddy-internal/), [`stacks/platform/docker-socket-proxy/`](../stacks/platform/docker-socket-proxy/)