Streamline AI docs, add skills, enforce symlink-everything policy

- Add .claude/skills/: homelab-context (auto-loads key facts each session),
  homelab-status (/homelab-status command), deploy-config (symlink setup guide)
- Remove AGENTS.md and ai/sessions/: superseded by plan mode + skill system
- Remove 4 obsolete session commands (session-start/list/switch, reload-instructions)
- Rewrite CLAUDE.md: remove duplicate content, enforce symlink policy, clarify sudo pattern
- Trim docs/services.md from 946 to ~230 lines: remove planning-era content,
  keep install steps and current status for migration reference
- Strip stale "sudo cp" deploy header from ssh-honeypot.service (now symlinked to repo)
- Update TODO.md: mark NAS migration and symlink tasks done, add jellyfin upgrade warning

TODO.md

@@ -1,5 +1,13 @@
 # Homelab TODO List
 
+## HIGH PRIO
+
+- [ ] Move all bigger storages to NAS if it isn't there already
+  - Gitea
+  - Nextcloud
+- [ ] Unify YADM configs across different systems
+  - use YADM alternatives method if needed for conflicts
+
 ## Network & Security
 - [x] DuckDNS dynamic DNS setup *(completed - ak-homelab.duckdns.org)*
 - [x] SSH security hardening *(documented in network-security.md)*
@@ -7,7 +15,7 @@
 - [x] Router port forwarding configuration
 - [x] !!! Set up geoblocking for SSH. Rest of SSH hardening already done.
 - [ ] !!! Modify syncthing to sync the NAS folders where appropriate (e.g. Logseq)
-- [ ] Dockerize everything and use symlinks for dockerfiles (tired of constantly copying stuff over)
+- [x] Dockerize everything and use symlinks for dockerfiles — all docker-compose files symlinked from `/opt/docker/` to repo `config/docker/`
 - [ ] !!! IMPORTANT: Run setup scripts made by security reviewer agent
   - [ ] Ran out of AI quota mid-security review so continue where we left off. Some scripts created but it's not
   complete yet
@@ -117,6 +125,18 @@ Lower priority - mostly using SSH or TTY anyways
 - [x] Figure out drag and drop window tiling solution -> workaround with keyboard shortcuts
 - [ ] Install multimedia codecs and applications
 
+## Docker Storage Migration
+- [x] Move Gitea storage to NAS — migrated to `/mnt/nas/docker-data/gitea/data` (USER_UID=1024:100 to match NAS ownership)
+- [x] Move Nextcloud storage to NAS — migrated to `/mnt/nas/docker-data/nextcloud/`
+- [ ] Persist copyparty index database to NAS — currently rebuilt from scratch on every restart (slow, scans entire NAS); mount `/mnt/nas/.copyparty-db` into the container so the index survives restarts
+- [ ] Clean up old leftover data: `/opt/docker/gitea/data/`, `/opt/docker/gitea/data.old/`, Docker volumes `gitea_gitea`, `nextcloud_nextcloud_data`, `nextcloud_nextcloud_db`
+
+## Docker Image Upgrades
+See `docs/docker-upgrade-plan.md` for full plan. Key warnings:
+- **Jellyfin**: v10.11+ does a major EF Core DB migration (`library.db` → `jellyfin.db`). Known to hang at "Saving BaseItem entries". **Back up jellyfin data volume before upgrading.**
+- **Redis**: Stay on `7-alpine` — Redis 8 has ACL breaking changes, not worth upgrading for a cache role
+- All containers are behind on updates as of 2026-02-27 (see plan doc for details)
+
 ## Security & Maintenance
 - [ ] Configure automatic security updates
 - [ ] Set up system monitoring and alerting