dashy-soc-board: add real evidence for the 'fourteen data sources' claim

Step 5 re-pass under the strengthened evidence gate. The 14-source
count was the doc's own opening framing claim but had no evidence
attached - I'd verified it live earlier this session (grepping the
real function for every upstream host it calls) but never actually
showed the work. Added it.

docs/dashy-soc-board.md

@@ -16,6 +16,17 @@ This board didn't start from nothing — it absorbed several formerly-standalone
 | Slack | 12 app-specific channels (the *arr suite, Jellyfin/Emby/Seerr, Kopia, Authentik, Gitea, Netbox, Grafana) mapped to their owning host by a plain lookup table, plus each host's own alert channel |
 | Proxmox `cluster/resources` API | The two hypervisor nodes' own CPU/RAM/disk (no Prometheus coverage on bare metal) plus the full running VM/LXC tree per node |
 
+The fourteen, enumerated directly from the function's own upstream calls rather than counted by hand:
+
+```
+$ grep -oE 'https?://[a-zA-Z0-9._-]+\.[service-to-service zone]' soc_board_func.js | sort -u
+authentik, hyper1 (Proxmox API), kestra, loki, n8n, pbs, prometheus,
+technitium, vault, wazuh-api, wazuh-indexer      → 11 distinct hosts
++ slack.com                                       → 12
++ fleetAudit (Node-RED global context, no HTTP call — see table above) → 13
++ pfSense (own dedicated collector, folded into the Prometheus query)  → 14
+```
+
 This is the real function, not a claimed size — one single Node-RED function, not several smaller ones stitched together:
 
 ```