chore: sanitize PII for public repo readiness

[smartwatermelon]

Summary

• Replace real server hostnames (MIMOLETTE, TILSIT), SSH access details (andrewrich@mimolette.local), and machine topology with generic placeholders in CLAUDE.md
• Replace hardcoded andrewrich username with <admin-user> in SPEC.md
• Replace real 1Password vault/item names and dotfiles repo URL with placeholder values in config.conf.template

Note: Git history was also rewritten via git filter-repo to purge docs/pia-split-tunnel-bug.md which contained a home public IP, VPN exit IP, and internal subnet. Main was force-pushed separately.

Context

Security audit to prepare this repo for public visibility. All script logic and functionality is unchanged — only docs and the config template were affected.

Test plan

• Verify no real hostnames remain: git grep -i 'mimolette\|tilsit\|asiago'
• Verify no IPs in history: git log --all -p -S '174.31.0.47'
• Verify config template has placeholder values
• Verify scripts still source config.conf correctly (template structure unchanged)

🤖 Generated with Claude Code

[claude]

PR #23 Review: Generalize hardcoded personal config values

This PR replaces hardcoded personal values (server names, usernames, 1Password item names, dotfiles repo) with generic placeholders across CLAUDE.md, SPEC.md, and config/config.conf.template. No executable shell scripts were modified.

Summary of Changes

• CLAUDE.md: Environment verification now references config.conf's SERVER_NAME instead of hardcoded names (TILSIT, MIMOLETTE); SSH sections generalized from andrewrich@mimolette.local to <user>@<server>.local
• SPEC.md: andrewrich → <admin-user> in hardware/architecture table and ADR explanation
• config/config.conf.template: 1Password vault/item names and DOTFILES_REPO changed from specific values to clear Your-* placeholder strings

Observations

Non-blocking — moderate maintenance impact:

CLAUDE.md environment verification (formerly line 13) now reads:

"known server name (listed in your config.conf as SERVER_NAME)"

This creates a potential chicken-and-egg issue: when an AI agent first runs and needs to determine which machine it's on, it now must read config.conf to learn what hostname to compare against — but config.conf is gitignored and may not exist on a fresh clone. The old explicit list (TILSIT, MIMOLETTE) was immediately actionable without a second file read. Consider retaining the pattern but noting it as an example:

- If hostname is **NOT** the value set as `SERVER_NAME` in `config.conf` (e.g., `TILSIT`, `MIMOLETTE`): you are on the **development Mac**

Non-blocking — low maintenance impact:

The SSH Access section previously gave a concrete, copy-pasteable command target (andrewrich@mimolette.local). The replacement <user>@<server>.local is correct for a public template but loses the specificity that made the memory entry useful for this specific setup. Acceptable trade-off given the generalization goal.

Security

The config.conf.template change is a clear improvement — removing actual 1Password vault/item names and a specific GitHub repo from a committed template file reduces accidental credential exposure for forks and contributors.

No code regressions

No shell scripts, service configurations, or executable logic were modified. All changes are documentation and the config template.

VERDICT: PASS