Sensitive tier: Paperless-ngx

[Gerrrt]

Sub-issue of #102.

What and why

Paperless-ngx GPL-3.0 Python/Docker — awesome-selfhosted README.md:755.

Scan, OCR, index and archive paper documents. The maintained fork of Paperless; the original and Paperless-ng are both dormant, so this is the only one worth deploying.

It earns its place on the sensitive tier by content rather than by size: a document archive is tax returns, insurance, medical records, passports and payslips. docs/security.md already reasons this way about what not to publish; the same logic puts this behind the same boundary as Vaultwarden (#131).

What it needs

• OCR is bursty CPU. Tesseract on a backlog scan will use everything it is given for minutes at a time. That is fine on an N100 and is one of the reasons the mini PC is being bought, but it makes a memory and CPU limit worth setting from day one rather than after the first OOM (Set memory limits on the six services to bound the blast radius of a leak #114, No resource limits on any container, and no size bound on retention #71).
• Postgres, Redis, and a consume directory.
• Secret key and database credentials in secrets/*.sops.yaml.
• A document-ingest path from a workstation on Hicks. The existing 50→99 rule already covers reaching it; no new rule.
• Storage sizing, and a backup that covers the archive and the database. An OCR index can be rebuilt; the originals cannot.

A note on scope

Paperless is a document archive, not a document editor, and it deliberately stops there. Stirling-PDF is filed separately for the merge/split/convert operations that otherwise send household paperwork to a random website — the two pair well, and neither wants to be the other.

Which VLAN this touches

🔴 99 — Winterfell (management)

Security review

• Does not weaken the default-deny posture between VLANs — reached from Hicks under the existing 50→99; no new rule
• Any new credential goes in secrets/*.sops.yaml
• Any new device is added to docs/network.md with an OUI-truncated MAC — n/a, unless a network scanner is added later, which would put a device with hard-coded credentials on a segment worth thinking about first

Depends on

#129 (Caddy) and the mini PC in #102. Related: #122.