feat(phase3): add scripts, diagrams, and lint integration

- scripts/tag.sh: CalVer validation + dual-remote push
- scripts/changelog.sh: prepend release entry to CHANGELOG
- scripts/lint-public.sh: public IP, .env, and setup file checks
- sync.sh: run lint before push
- public/assets/: Mermaid diagrams for network topology, DNS chain, auth flow
- CLAUDE.md: update current phase to Phase 3

assets/dns-chain.md

@@ -0,0 +1,9 @@
+# DNS Resolution Chain
+
+```mermaid
+graph LR
+  D[Device] --> PH[Pi-hole\n10.2.0.11]
+  PH --> UB[pfSense Unbound\n10.x.0.1]
+  UB --> CF[Cloudflare\n1.1.1.1]
+  PH -- "*.lerkolabs.com" --> CADDY[Caddy\n10.2.0.20]
+```