docs: infrastructure audit — app inventory, backups, CI, provider pricing, agent fleet

Audit of the operator docs against live reality (2026-11-04):
- app-inventory.md: all 19 Cloudron apps with id, fqdn and registry image pin.
  Corrects the portal path (code/member-portal, not co-op/member-portal) and the
  panel path (local/coop.inference.admin-panel, not code/admin-panel).
- maintenance/backups.md: the two backup systems; the deliberate per-user restic
  cache split and the --group-by "" retention fix, with why.
- maintenance/woodpecker-ci.md: CI server + agent, image build/pin, manual-only
  trigger, git-lfs requirement, and its current not-yet-green state (agent's
  job-collection long-poll gets HTTP 500 from the server).
- provider-pricing/: index + GreenPT, Tinfoil (local EHBP proxy architecture) and
  the Metis /v1/systemone decision-model route; regolo.md updated to record the
  gateway prices were applied.
- agent-fleet.md: steward, infrastructure-bot and socialbot (Unix users, gateway
  units, teams); member-bot tier 2 planned but not yet provisioned.
- README: file list; operator-token-runbook: correct the membership_sweep cadence
  (3x daily, not nightly); migration doc: post-migration addendum (16->19 apps,
  DNS split resolved, old box still on with apps stopped).

provider-pricing/greenpt.md

@@ -0,0 +1,44 @@
+# GreenPT pricing
+
+GreenPT is OpenAI-compatible, EU-hosted on **100% renewable energy**. LiteLLM
+talks to it **directly** (no TEE proxy). Billing across the gateway:
+
+- `api_base`: `https://api.greenpt.ai/v1`
+- key: `GREENPT_API_KEY` (gateway app env)
+
+## What we serve, and what it costs
+
+Rates as recorded in the gateway's authorititative config comment, **USD per 1M
+tokens** (the gateway's `model_info` carries the per-token equivalents):
+
+| our model | input | output | cached input |
+|---|---|---|---|
+| `greenpt/deepseek-v4.1-flash` **(DEFAULT model)** | $0.22 | $1.10 | $0.011 |
+| `greenpt/glm-5.3-flash` | $0.11 | $0.44 | $0.022 |
+| `greenpt/glm-5.3` | $1.10 | $4.40 | $0.275 |
+
+- **`greenpt/deepseek-v4.1-flash` is the gateway's default model.** It is the same
+  model family as Tinfoil's `tinfoil/deepseek-v4-1-flash`, but on renewable energy
+  and **not** marked "Experimental" by the provider (Tinfoil's counterpart is), so
+  it is the default and Tinfoil's is its private counterpart. The policy trade is
+  **policy-based privacy (GreenPT) vs TEE (Tinfoil)** — say so plainly rather than
+  implying GreenPT is confidential computing.
+- `greenpt/glm-5.3` is the strongest **agentic** model in the green tier (1M context).
+- Note the **dotted slug** `glm-5.3-flash` on GreenPT, distinct from Tinfoil's
+  `glm-5-3-flash` (hyphenated). Getting a model slug wrong is a silent 404 at call
+  time.
+
+## Historical
+
+- **Removed 2026-10:** `green-l` / `green-r` — GreenPT now marks them "not
+  recommended".
+- The config comment previously read "€0.22 in / €1.10 out" alongside the dollar
+  figures — see the currency note in `README.md`; the intended FX is unverified.
+
+## The fallback key
+
+`GREENPT_FALLBACK_API_KEY` (agent host) is the **same value** as the gateway's
+`GREENPT_API_KEY` — verified by hash comparison. It powers the steward agent's
+direct-to-provider fallback during a gateway outage. **Rotating one without the
+other silently breaks the fallback** (a dedicated key is the cleaner end state).
+See the token runbook.