Document VM 102 security stack and update IPs to 192.168.1.105.

Add ARCHITECTURE.md and HOMELAB_IPS.md, refresh inventory and app configs
for Postgres, Neo4j, Homelab Command, pgAdmin, Homarr, and Homepage links.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/home-security-agent/.env.example

@@ -2,8 +2,8 @@
 TELEGRAM_BOT_TOKEN=
 TELEGRAM_CHAT_ID=
 
-# PostgreSQL — observaties voor dashboard http://192.168.1.211:8765
-PG_HOST=192.168.1.211
+# PostgreSQL — observaties voor dashboard http://192.168.1.105:8765
+PG_HOST=192.168.1.105
 PG_PORT=5433
 PG_USER=mo
 PG_PASSWORD=

apps/home-security-agent/README.md

@@ -52,12 +52,13 @@ Voeg in `targets.yaml` services toe. Voor diepere agent-gedrag later:
 
 Alle observaties gaan naar **PostgreSQL** (`agent.observation_runs`, `agent.findings`, `agent.incidents`).
 
-Bekijk ze in **Homelab Command**: http://192.168.1.211:8765/dashboard#security (tab Security → Home Security Agent).
+Bekijk ze in **Homelab Command**: http://192.168.1.105:8765/dashboard#security (tab Security → Home Security Agent).
 
 Eénmalig schema:
 
 ```bash
 docker exec -i postgres-homelab psql -U mo -d homelab < migrations/004_home_agent_observations.sql
+# Postgres draait op VM 102: ssh mo@192.168.1.105 → docker exec postgres-homelab psql ...
 ```
 
 Of vanuit homelab-command: `scripts/apply_mesh_migrations.sh` (past alle `migrations/*.sql` toe).

apps/home-security-agent/agent/pg_store.py

@@ -25,7 +25,7 @@ def _connect():
     if url:
         return psycopg2.connect(url)
     return psycopg2.connect(
-        host=os.getenv("PG_HOST", "192.168.1.211"),
+        host=os.getenv("PG_HOST", "192.168.1.105"),
         port=int(os.getenv("PG_PORT", "5433")),
         user=os.getenv("PG_USER", "mo"),
         password=os.getenv("PG_PASSWORD", ""),

apps/home-security-agent/config/targets.yaml

@@ -34,7 +34,7 @@ services:
     url: https://192.168.1.185:30058
     insecure_tls: true
   - name: Homelab Command
-    url: http://192.168.1.211:8765
+    url: http://192.168.1.105:8765
 
 # Optioneel: bekende apparaten op LAN (ARP/ping — geen externe SIEM)
 lan_watch:

apps/home-security-agent/docker-compose.yml

@@ -8,7 +8,7 @@ services:
     env_file:
       - .env
     environment:
-      PG_HOST: ${PG_HOST:-192.168.1.211}
+      PG_HOST: ${PG_HOST:-192.168.1.105}
       PG_PORT: ${PG_PORT:-5433}
       PG_USER: ${PG_USER:-mo}
       PG_PASSWORD: ${PG_PASSWORD:-}