Add the Suricata dual-layer detail (DNS lockdown, Vault protection each enforced independently at two layers) and honest live-backend churn instead of a flat inventory list. Drop the disabled-LAN-frontend TIP entirely — not worth keeping in the public doc.