docs: Update network plan - OPNsense on pm4 with USB NIC

- OPNsense moves to pm4 (server closet, next to AT&T modem)
- USB 2.5G NIC for WAN (~$25), Intel I226-V for LAN
- pm4 has USB 3.1 (10Gbps) - verified
- Updated topology diagram with pm4/OPNsense placement
- Total cost now ~$605

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs/DECISIONS.md

@@ -61,17 +61,26 @@
 
 ### Router/Firewall (Planned)
 
-**Decision**: OPNsense VM on Elantris
+**Decision**: OPNsense VM on pm4 (server closet)
 **Reason**:
 - Free, full-featured firewall/router
 - VLAN routing and inter-VLAN firewall rules
 - IDS/IPS capability
-- Elantris has ample resources (128GB RAM)
+- pm4 is in server closet next to AT&T modem (avoids routing WAN over backhaul)
+- pm4 has Intel I226-V (2.5G) + USB 3.1 for second NIC
+
+**Network Interfaces**:
+- WAN: USB 2.5G NIC (~$25) → AT&T modem
+- LAN: Intel I226-V → GiGaPlus switch (VLAN trunk)
 
 **Alternative Considered**: Ubiquiti Dream Machine
 - Rejected due to cost and ecosystem lock-in
 - OPNsense more flexible for homelab
 
+**Alternative Considered**: OPNsense on Elantris (basement)
+- Rejected because WAN would need to traverse 10G backhaul
+- Would require managed switches for WAN VLAN isolation
+
 ### 10G Backhaul (Planned)
 
 **Decision**: 10G RJ45 between server closet and basement