docs: fix dashy-soc-board.md drift (Vault data-sourcing accuracy, Netbox->Proxmox channel, function size)

Vault panel data was overstated as fully live; only CA cert expiry
actually is - the rest comes from a cached Prometheus query. Slack
channel list still named the decommissioned Netbox app instead of
the real Proxmox channel.

docs/dashy-soc-board.md

@@ -1,4 +1,4 @@
-<!-- verified: 2026-09-06
+<!-- verified: 2026-09-19
      trilium : 5XjzoVTH1r3B, cVFNSn4CuuEN
 -->
 
@@ -14,10 +14,10 @@ This board didn't start from nothing — it absorbed several formerly-standalone
 | Source | What it actually contributes |
 |---|---|
 | Wazuh indexer | 7-day findings, categorized: ClamAV, vulnerabilities, rootkit/anomaly, authentication, other |
-| Vault | Seal state, active lease/token counts, KV engine counts, token TTL distribution, and root/intermediate CA cert expiry — parsed live from Vault's own `pki/cert/ca` and `pki_int/cert/ca` endpoints on every load, not a cached value |
+| Vault | Seal state, active lease/token counts, KV engine counts, and token TTL distribution — read from Prometheus metrics, not a live Vault call, so all of them go stale together if the metrics-reader token lapses. Root/intermediate CA cert expiry is the one exception, parsed live from Vault's own `pki/cert/ca` and `pki_int/cert/ca` endpoints on every load regardless of metrics health |
 | Technitium DNS | Query stats, top clients/domains, blocklist state, plus a dedicated "DNS Security Signals" section: forwarder failures (read from the Loki-shipped query log), query-log ingestion lag, next blocklist update time |
 | Fleet config-drift audit | *Not* computed by this board's own function — read from Node-RED's shared `fleetAudit` global, populated by a separate ingestion process, covering 4 finding types: untracked stacks, missing declared directories, containers stuck in `Created`, and TZ drift |
-| Slack | 12 app-specific channels (the *arr suite, Jellyfin/Emby/Seerr, Kopia, Authentik, Gitea, Netbox, Grafana) mapped to their owning host by a plain lookup table, plus each host's own alert channel |
+| Slack | 12 app-specific channels (the *arr suite, Jellyfin/Emby/Seerr, Kopia, Authentik, Gitea, Proxmox, Grafana) mapped to their owning host by a plain lookup table, plus each host's own alert channel |
 | Proxmox `cluster/resources` API | The two hypervisor nodes' own CPU/RAM/disk (no Prometheus coverage on bare metal) plus the full running VM/LXC tree per node |
 
 The fourteen, enumerated directly from the function's own upstream-URL constants rather than counted by hand — this is the actual grep and its real output, not a reconstruction:
@@ -48,7 +48,7 @@ for n in data:
     if n.get('type') == 'function' and n.get('name') == 'Build SOC Board HTML':
         print(n['name'], '->', len(n['func']), 'chars')
 "
-Build SOC Board HTML -> 104443 chars
+Build SOC Board HTML -> 104635 chars
 ```
 
 ## Why One Function Instead of Native Dashy Widgets