netbird-zero-trust.md: new doc for the zero-trust mesh overlay

New file covering NetBird - a self-hosted WireGuard mesh giving every
fleet host and personal device a stable overlay identity, with a
genuinely-implemented zero-trust policy layer (deny-by-default, groups,
scoped setup keys, peer approval, posture checks).

- Why a mesh over a classic VPN concentrator, illustrated with a real
  topology diagram (control plane handles coordination only; actual
  data flows peer-to-peer, bypassing it entirely - the literal
  distinction from a concentrator, drawn not just asserted)
- Ties back to today's iac-pipeline.md update: this LXC is the first
  host ever built through the new Terraform LXC-native path, start to
  finish, no manual provisioning step
- Real bring-up incident: gRPC/h2c requirements broke through a naive
  proxy chain, and a proxying CDN 403s the agent outright - both root
  causes documented, not just the fixes
- Evidence: 3 real command blocks (docker ps, live Caddyfile splitter
  config, netbird status --detail from an enrolled peer), 2 real
  screenshots (dashboard Peers list, Access Control Policies - port
  counts in the screenshot match the real policy detail in the text)
- Second diagram (edge routing chain) for the specific gRPC/h2c/path
  split detail, kept separate from the topology diagram since they show
  genuinely different shapes of information
- Honest, non-rounded-up rollout status table - several phases still
  explicitly open
- Sanitize-checked: no internal IPs/domains/personal email

Also: fixes iac-pipeline.md's forward-reference to this doc to use the
repo's actual link convention ([docs/x.md](x.md)), not descriptive
prose link text.

docs/iac-pipeline.md

@@ -169,7 +169,7 @@ Compliance hardening runs as a set of independently-tagged sub-roles, selected p
 >
 > A third host breaks the model in a genuinely different way — not a variation on the same story, a different one entirely. Proxmox Backup Server runs as the vendor's own official Debian-based appliance image, deployed by hand and never a Terraform resource at all — there's no commented-out entry to preserve, because there was never a Terraform-managed version of it to convert away from. It still ended up on the tag-driven Ansible side of the pipeline: wired into its own inventory group and given a hand-written tag list after the fact, since compliance only ever checks whether a tag is present, not how a host arrived in the inventory. It's also the fleet's only non-Rocky host, which surfaced a real gap in one of the 9 hardening sub-roles above: `password_policy` configures PAM lockout behavior, and the ordering it assumes is Rocky's own — safe on every other host, but wrong on this one until it was fixed at the role level and explicitly re-validated.
 >
-> None of these three exceptions were retroactively fixed once the LXC-provider gap closed — the point of preserving history is that it stays history, not that it gets quietly cleaned up the moment it becomes possible to. But the gap itself is real and worth naming honestly too: for any *new* LXC going forward, this entire honest-exception story no longer applies. The fleet's [zero-trust mesh overlay](netbird-zero-trust.md) is the first host actually built through the LXC-native path above, start to finish, with no manual step anywhere in its provisioning.
+> None of these three exceptions were retroactively fixed once the LXC-provider gap closed — the point of preserving history is that it stays history, not that it gets quietly cleaned up the moment it becomes possible to. But the gap itself is real and worth naming honestly too: for any *new* LXC going forward, this entire honest-exception story no longer applies. The mesh overlay in [`docs/netbird-zero-trust.md`](netbird-zero-trust.md) is the first host actually built through the LXC-native path above, start to finish, with no manual step anywhere in its provisioning.
 
 ---
 Related: [`docs/secrets-and-pki.md`](secrets-and-pki.md), [`docs/security-monitoring.md`](security-monitoring.md), [`docs/disaster-recovery.md`](disaster-recovery.md), [`docs/netbird-zero-trust.md`](netbird-zero-trust.md)