Check in scripts/configs, organized and documented by host OS

Every script/config built this session (sanity-check, attacker-check,
the Gitea backup pipeline on both ends) now lives in this repo as
reference copies, not just described in prose - previously they only
existed on the live servers.

Split into scripts/alpha/ (Ubuntu 24.04.4 LTS) and
scripts/clients/vlda-01/ (Unraid 7.3.2), each with its own README
stating the exact OS/kernel and a file-by-file map to deployed paths,
since a script written for one host's conventions doesn't just work
unchanged on the other - the vlda-01 README in particular documents
the persistence gotchas that actually broke earlier attempts (RAM-
backed root filesystem, VFAT /boot with no execute bit, Unassigned
Device auto-mount). Root README.md now links directly to these files
from each relevant section instead of only describing them.

Explicitly not included: the dedicated SSH private key vlda-01 uses to
authenticate to alpha - noted in clients/vlda-01/README.md to
regenerate rather than ever commit one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/README.md

@@ -0,0 +1,36 @@
+# Scripts and configs — checked-in reference copies
+
+This directory holds the actual scripts and config files running on
+`alpha.jayfield.org` and its backup client(s), checked into git so they're
+versioned and reviewable alongside the prose docs that explain *why* they
+exist (`README.md`, `TODO.md`, `SYNC-PLAN.md` in the repo root).
+
+**These are reference copies, not a deployment source.** Editing a file
+here does not change anything on the live server — there is no CI/CD or
+sync mechanism pulling from this repo onto either host (matching this
+whole repo's existing convention: "changes are made directly on the
+server and recorded here afterward", see the root `README.md`). After
+changing something on a live host, re-fetch it into this directory so the
+checked-in copy doesn't drift from reality.
+
+## Layout
+
+- `alpha/` — scripts and configs that run **on `alpha.jayfield.org`
+  itself** (Ubuntu 24.04 LTS — see `alpha/README.md` for the exact
+  version/kernel).
+- `clients/` — scripts and configs that run on other hosts this project
+  administers, each in its own subdirectory named after the host. Currently
+  just `clients/vlda-01/` (Unraid — see its own `README.md`), but structured
+  to hold more if that ever grows (see `SYNC-PLAN.md` for what else lives
+  on `vlda-01`).
+
+**Why this split matters**: `alpha` and its clients run different, often
+very different, operating systems (Ubuntu vs. Unraid so far) — a script
+written for one's conventions (systemd, `/etc/cron.d`, standard persistent
+filesystem) will not just drop into the other unchanged (Unraid's `/` and
+`/usr` are RAM-backed and don't survive a reboot, its own scheduling is
+via the User Scripts plugin, not raw crontab — see `clients/vlda-01/README.md`
+for the specifics that tripped this up while building it). Each
+subdirectory's `README.md` states the exact OS/version a script was
+written for, so anyone reusing these later — including future-me — knows
+whether a given script's assumptions still hold.