docs: Network infrastructure cleanup - static IPs, local DNS, SSH access

- Complete static IP migration for all containers
- Configure Pi-hole local DNS with .kav hostnames
- Add SSH provisioning script for all containers
- Create NETWORK-MAP.md with complete IP allocation
- Create network-map.sh for dynamic map generation
- Update INFRASTRUCTURE.md with new service map
- Add .kav TLD and SSH policy decisions to DECISIONS.md

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 > **Purpose**: Historical record of all significant infrastructure changes
 
+## 2025-12-28
+
+### Network Infrastructure Cleanup
+
+#### Static IP Migration Complete
+All containers now have static IPs in organized ranges:
+- **Core Infrastructure** (10.4.2.10-19): Pi-hole→.11, Authelia→.12, Vaultwarden→.15
+- **Media Stack** (10.4.2.20-29): All *arr services, Jellyfin, etc.
+- **Services** (10.4.2.30-39): Immich→.30, Gitea→.31, Frigate→.32, Ollama→.34
+- **IoT** (10.4.2.50-99): Z-Wave→.50, MQTT→.51
+- **Docker Hosts** (10.4.2.200-209): docker-pm2→.200, docker-pm4→.201
+
+#### Pi-hole Local DNS (.kav domain)
+- Configured Pi-hole (10.4.2.11) as local DNS resolver
+- All services now have `.kav` hostnames (e.g., traefik.kav, sonarr.kav)
+- DNS records added via `dns.hosts` array in `/etc/pihole/pihole.toml`
+
+#### SSH Access to All Containers
+- Created provisioning script: `scripts/provisioning/setup-ssh-access.sh`
+- All LXC containers now have SSH enabled with key-based auth
+- Access via: `ssh root@<service>.kav`
+
+#### Traefik Route Updates
+- Updated backend IPs for: authelia.yaml, vaultwarden.yaml, pihole.yaml
+- All routes now point to new static IPs
+
+#### Documentation Updates
+- Created `docs/NETWORK-MAP.md` with complete IP allocation
+- Created `scripts/monitoring/network-map.sh` for dynamic map generation
+- Updated `docs/INFRASTRUCTURE.md` with new service map
+- Updated gateway references from 10.4.2.254 to 10.4.2.1
+
+#### Pending
+- Update OPNsense DHCP to distribute Pi-hole (10.4.2.11) as DNS
+- Configure Home Assistant static IP (10.4.2.33) via HAOS UI
+
 ## 2025-12-22
 
 ### NAT Reflection & External Access Fix