Add homelab services stack PRD

Verifies 16 DockerHub images, assigns target nodes per locked policy,
defines 3-phase deployment order (Infra → Media → Polish),
and captures open questions for Bobby.

Services: Traefik, Technitium DNS, AdGuard Home, Prometheus, Grafana,
Beszel, Dozzle, Portainer, Homepage, Authelia, Vaultwarden, Jellyfin,
Sonarr, Radarr, Prowlarr, Nextcloud

Domain: *.ai.home
No public internet exposure.

plans/01-purpose-and-scope.md

@@ -0,0 +1,30 @@
+# Iron Legion Homelab Services Stack — Purpose & Scope
+
+## Document ID
+- **PRD:** homelab-services-stack-prd.md
+- **Date:** 2026-05-25
+- **Owner:** Artemis (AI Foreman, Iron Legion Labs)
+- **Authority:** Commander Bobby
+
+## Purpose
+Central canonical reference for all Docker/Compose-based services Iron Legion Labs intends to deploy across the fleet. This document exists to:
+1. Prevent duplicate research — every service's Docker image, metadata, and deployment pattern is captured once.
+2. Guide node placement — which service runs where, and why.
+3. Serve as the source of truth for Ansible-pull manifests, compose files, and future automation.
+
+## Scope
+### In Scope
+- Service catalog with DockerHub-verified images (name, namespace, description, pull count, stars, last update)
+- Category assignment (Network, Monitoring, Media, Security, Management, Infrastructure)
+- Recommended target node per service
+- Deployment phase priority
+- High-level network, data, and security architecture
+
+### Out of Scope
+- Detailed compose-file YAML (deferred to per-service deployment PRDs)
+- Specific Traefik middleware configurations (deferred to network PRD)
+- GPU passthrough configs for media transcode (deferred to Mark44 workload PRD)
+- Service-specific SSO/authelia rule authoring (deferred to security PRD)
+
+## Living Document
+This PRD is append-only for new services. Modifications to existing entries require Bobby sign-off. Additions follow the raw-metadata-to-summary pattern established in Section 4.