Resolve OQ-1/2/3, refine OQ-4: single ExpressVPN gateway, single WAN, external media

Operator answers folded into the specs:
- OQ-3 VPN: ExpressVPN, cluster-controlled SINGLE shared in-cluster tunnel
  (OpenVPN UDP / non-TCP), rules enforced outside the service. New ADR-0012
  supersedes ADR-0008 (Gluetun-sidecar default dropped). Central kill-switch.
- OQ-1 WAN/edge: one commercial WAN, no multi-ISP plans; dumb SOHO edge (no
  VLAN/VPN/services). Multi-WAN out of scope; segmentation + VPN in-cluster;
  edge = NAT + manual port-forward. Gateway VIP resolved to Cilium L2
  announcement. T-3.3 marked won't-do.
- OQ-2 storage: bulk media lives outside the cluster (backing TBD, non-blocking)
  via a 'bulk' external-mount indirection; Plex metadata DB stays on Longhorn.
  Split out a separate OQ-BKP for the off-cluster DR backup target (Phase 4).
- OQ-4 refined: wildcard record covers reachability but NOT ACME DNS-01 (needs
  TXT-write access) and does not match *.home.* depth. Still OPEN: Cloudflare
  API token (Option A) vs acme-dns delegation (Option B). T-2.4/T-2.5 blocked.

Updated: docs 00,01,03,04,08,09; ADR-0008/0012 + index; task board.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/04-storage-and-state.md

@@ -39,18 +39,19 @@ service comes back with its data. This is verified per service, not assumed.
 ## Bulk media strategy (R-STATE-04 — the Plex problem)
 
 Plex is the largest service and its library can be multiple terabytes. **3× replicating multi-TB
-media across three mini-PCs is impractical** (capacity and cost). Therefore bulk media is a
-**distinct tier** from replicated app-config storage. Options to be pinned by ADR-0003 / OQ-2:
+media across three mini-PCs is impractical** (capacity and cost). Per **OQ-2 (resolved)**, **bulk
+media lives OUTSIDE the cluster**; the specific backing is **to be determined later** and does not
+block the core platform.
 
-- **NAS / external NFS** exporting the media library, mounted into Plex (and the arr stack) — keeps
-  bulk data off the replicated tier; simplest capacity story; introduces an external dependency.
-- **Dedicated large disk** on one node with **single-replica Longhorn** or a local PV — cheaper, but
-  node-bound; requires its own backup plan.
-- **Object storage** for some content — generally poor fit for Plex direct play.
+- The bulk store is consumed by Plex and the arr stack as an **external mount** (NFS/SMB share to be
+  specified when chosen). The `bulk` StorageClass / mount is a thin indirection so the concrete
+  backing can be filled in later without touching service definitions.
+- Downloads (qbittorrent) stage to the bulk store and hand off to the arr stack.
 
-Regardless of choice: **Plex's config/metadata database is small and MUST live on 3-replica
-Longhorn** (so Plex rebuilds cleanly); only the large media files use the bulk tier. Downloads
-(qbittorrent) stage to the bulk tier and hand off to the arr stack.
+**Regardless of the bulk backing: Plex's config/metadata database is small and MUST live on 3-replica
+Longhorn** (so Plex rebuilds cleanly); only the large media files use the external bulk store. Bulk
+media is treated as **`reacquirable`** for backup purposes unless the operator specifies otherwise
+when the backing is chosen.
 
 ## Backup & disaster recovery (R-STATE-03)
 
@@ -86,6 +87,12 @@ rebuilt from its declarative definition + persistent disk. See [`06-vm-workloads
 - Restore a namespace + volumes from off-cluster backup into a clean state (DR drill).
 - Plex rebuilds with its metadata DB from replicated storage; media re-attaches from the bulk tier.
 
+## Resolved
+- **OQ-2** — bulk media lives **outside the cluster**; concrete backing **TBD later** (consumed as an
+  external NFS/SMB mount via the `bulk` indirection). Does not block the core platform.
+
 ## Open questions
-- **OQ-2** — final bulk-media home (NAS/NFS vs dedicated disk vs mixed) and its backup posture.
-- Off-cluster backup **target**: which S3-compatible endpoint or NFS host, and its own resilience.
+- **Off-cluster DR backup target** (separate from bulk media): which S3-compatible endpoint or NFS
+  host holds Velero/Longhorn backups of the *irreplaceable* tier (app config, Nextcloud, Gitea, DBs),
+  and its own resilience. Needed by **Phase 4**, not Phase 2.
+- Concrete bulk-media backing + whether any of it is non-`reacquirable` (operator decides when chosen).