Resolve OQ-1/2/3, refine OQ-4: single ExpressVPN gateway, single WAN, external media

Operator answers folded into the specs:
- OQ-3 VPN: ExpressVPN, cluster-controlled SINGLE shared in-cluster tunnel
  (OpenVPN UDP / non-TCP), rules enforced outside the service. New ADR-0012
  supersedes ADR-0008 (Gluetun-sidecar default dropped). Central kill-switch.
- OQ-1 WAN/edge: one commercial WAN, no multi-ISP plans; dumb SOHO edge (no
  VLAN/VPN/services). Multi-WAN out of scope; segmentation + VPN in-cluster;
  edge = NAT + manual port-forward. Gateway VIP resolved to Cilium L2
  announcement. T-3.3 marked won't-do.
- OQ-2 storage: bulk media lives outside the cluster (backing TBD, non-blocking)
  via a 'bulk' external-mount indirection; Plex metadata DB stays on Longhorn.
  Split out a separate OQ-BKP for the off-cluster DR backup target (Phase 4).
- OQ-4 refined: wildcard record covers reachability but NOT ACME DNS-01 (needs
  TXT-write access) and does not match *.home.* depth. Still OPEN: Cloudflare
  API token (Option A) vs acme-dns delegation (Option B). T-2.4/T-2.5 blocked.

Updated: docs 00,01,03,04,08,09; ADR-0008/0012 + index; task board.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/00-vision-and-scope.md

@@ -74,10 +74,15 @@ mandatory; `SHOULD` is strongly preferred and requires an ADR to deviate.
   destination → port/protocol.
 - **R-NET-03** — Networks MUST be configurable and isolatable (segments/namespaces with enforced
   boundaries).
-- **R-NET-04** — The platform MUST support **multiple WANs** with egress selection driven by routing
-  rules.
+- **R-NET-04** — The platform MUST support **multiple egress paths** selected by routing rules. Per
+  OQ-1 the environment has **one physical commercial WAN and no multi-ISP plans**, so this is
+  realized as two paths — the local `internet` path and the in-cluster `vpn` path — not multi-ISP
+  routing. Physical multi-WAN (multiple ISP uplinks) is **out of scope** unless a future ADR reopens
+  it.
 - **R-NET-05** — A service MUST be able to declare its **egress class**: `internet` (standard local
-  network/internet) or `vpn` (routed through a custom VPN connection).
+  network/internet) or `vpn` (routed through a custom VPN connection). VPN routing MUST be enforced
+  **outside the service** (a single shared in-cluster gateway), so a service cannot leak by
+  misconfiguration (ADR-0012, OQ-3).
 - **R-NET-06** — VPN-class egress MUST enforce a **kill-switch**: if the VPN tunnel is down, the
   service MUST NOT leak traffic to the standard internet.
 - **R-NET-07** — Egress class MUST be a declarative property of the service, changeable via GitOps
@@ -176,14 +181,24 @@ demonstration. The testing approach is specified in
 implement against the spec and prove conformance with tests; they never edit the spec to fit the
 implementation.
 
-## Open questions (tracked, not blocking the architecture)
+## Open questions
 
-- **OQ-1 (WAN hardware)**: How many physical WAN uplinks exist in prod, and does the edge router do
-  the multi-WAN policy routing, or is a portion done in-cluster via egress gateways? See
-  [`03-networking-isolation-and-egress.md`](03-networking-isolation-and-egress.md).
-- **OQ-2 (bulk media)**: Final home for the Plex media library — NAS/NFS vs. a dedicated large disk
-  vs. object storage. See [`04-storage-and-state.md`](04-storage-and-state.md) / ADR-0003.
-- **OQ-3 (VPN provider)**: Commercial VPN provider + protocol (WireGuard preferred) and how many
-  concurrent tunnels/egress IPs are available.
-- **OQ-4 (DNS provider API)**: Confirm Cloudflare (or equivalent) manages `keithjackson.dev` with an
-  API token scoped for ACME DNS-01 and ExternalDNS.
+### Resolved (2026-08-15)
+- **OQ-1 (WAN / edge)** — **RESOLVED**: one commercial WAN, no multi-ISP plans; dumb SOHO edge (no
+  VLAN/VPN/services). All segmentation + VPN in-cluster; edge does NAT + port-forward only. Physical
+  multi-WAN out of scope. See [`03`](03-networking-isolation-and-egress.md), [`09`](09-dns-and-ingress.md).
+- **OQ-2 (bulk media)** — **RESOLVED (deferred backing)**: Plex bulk media lives **outside the
+  cluster**; the specific backing is **TBD later** and does not block the core platform. Plex's
+  metadata DB still lives on replicated Longhorn. The **off-cluster DR backup target** (for app
+  config, Nextcloud, Gitea, etc.) remains to be chosen at Phase 4. See [`04`](04-storage-and-state.md).
+- **OQ-3 (VPN)** — **RESOLVED**: **ExpressVPN**, cluster-provisioned, **single shared in-cluster
+  tunnel**, **non-TCP** (OpenVPN UDP / Lightway-UDP), rules enforced outside the service
+  (ADR-0012). See [`03`](03-networking-isolation-and-egress.md).
+
+### Still open
+- **OQ-4 (TLS/DNS challenge access)**: Cloudflare already has a wildcard `*.keithjackson.dev` → public
+  IP (covers reachability), but **ACME DNS-01 needs write access** to create `_acme-challenge` TXT
+  records, and `*.keithjackson.dev` does **not** match the two-label-deep `*.home.keithjackson.dev`.
+  Decide the challenge mechanism: **(a)** a scoped Cloudflare **API token** (Zone·DNS·Edit) → fully
+  automated DNS-01 + ExternalDNS, or **(b)** **acme-dns delegation** (one-time `_acme-challenge`
+  CNAME edit, then no standing Cloudflare credential). See [`08`](08-tls-and-certificates.md).