P5.1: Migrate minikube from podman to QEMU2 driver (#38)

## Summary
- Migrate minikube from podman driver to qemu2 driver for proper NFS/SMB volume mount support
- Update ansible minikube role with qemu installation and containerd runtime
- Remove podman role dependency from indri.yml
- Add synology user creation steps and post-migration zot reconfiguration notes

## Why
Phase 6 (Kiwix/Transmission migration) was blocked because the podman driver lacks kernel capabilities for filesystem mounts. QEMU2 creates an actual VM with full mount support.

## Deployment and Testing
- [ ] Create k8s-storage user on Synology DSM
- [ ] Store credentials in 1Password (synology-k8s-storage)
- [ ] Export current k8s state
- [ ] Stop and delete podman-based minikube cluster
- [ ] Run ansible to create QEMU2 cluster
- [ ] Test NFS volume mount with test pod
- [ ] Redeploy ArgoCD and all apps
- [ ] Verify all services healthy
- [ ] Reconfigure zot registry mirrors for containerd (post-migration)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/38

argocd/manifests/argocd/service-tailscale.yaml

@@ -10,7 +10,7 @@ metadata:
   name: argocd-server-tailscale
   namespace: argocd
   annotations:
-    tailscale.com/proxy-class: "crio-compat"
+    tailscale.com/proxy-class: "default"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/databases/service-tailscale.yaml

@@ -7,7 +7,7 @@ metadata:
   namespace: databases
   annotations:
     tailscale.com/hostname: "pg"
-    tailscale.com/proxy-class: "crio-compat"
+    tailscale.com/proxy-class: "default"
 spec:
   type: LoadBalancer
   loadBalancerClass: tailscale

argocd/manifests/devpi/ingress-tailscale.yaml

@@ -4,7 +4,7 @@ metadata:
   name: devpi-tailscale
   namespace: devpi
   annotations:
-    tailscale.com/proxy-class: "crio-compat"
+    tailscale.com/proxy-class: "default"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/grafana-config/ingress-tailscale.yaml

@@ -8,7 +8,7 @@ metadata:
   name: grafana-tailscale
   namespace: monitoring
   annotations:
-    tailscale.com/proxy-class: "crio-compat"
+    tailscale.com/proxy-class: "default"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/miniflux/README.md

@@ -60,3 +60,13 @@ Connects to PostgreSQL via internal k8s DNS:
 
 The database is also accessible externally via Tailscale at:
 `pg.tail8d86e.ts.net:5432`
+
+## Restore from Backup
+
+If the database needs to be restored from a borgmatic backup:
+
+1. List archives: `borgmatic list`
+2. Extract dump from archive using `borg extract` to `/tmp/restore`
+3. Restore with `pg_restore --clean --if-exists --no-owner --no-acl`
+4. Fix ownership - ensure user `miniflux` owns all tables, sequences, and types in the `public` schema (restore runs as `eblume`)
+5. Restart miniflux deployment

argocd/manifests/miniflux/ingress-tailscale.yaml

@@ -4,7 +4,7 @@ metadata:
   name: miniflux-tailscale
   namespace: miniflux
   annotations:
-    tailscale.com/proxy-class: "crio-compat"
+    tailscale.com/proxy-class: "default"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/tailscale-operator/README.md

@@ -6,7 +6,7 @@ Manifests for the Tailscale Kubernetes Operator, managed via ArgoCD.
 
 - `operator.yaml` - Static manifest from https://github.com/tailscale/tailscale/tree/main/cmd/k8s-operator/deploy/manifests
 - Secret block removed from `operator.yaml` - managed separately via `secret.yaml.tpl`
-- Image reference changed to fully-qualified `docker.io/tailscale/k8s-operator:stable` for CRI-O compatibility
+- Image reference changed to fully-qualified `docker.io/tailscale/k8s-operator:stable`
 
 ## Prerequisites
 
@@ -71,7 +71,7 @@ kubectl logs -n tailscale -l app.kubernetes.io/name=operator
 |------|-------------|
 | `kustomization.yaml` | Kustomize configuration for all manifests |
 | `operator.yaml` | Operator deployment, CRDs, RBAC (secret removed) |
-| `proxyclass.yaml` | ProxyClass with fully-qualified images for CRI-O |
+| `proxyclass.yaml` | ProxyClass with fully-qualified images |
 | `dnsconfig.yaml` | DNSConfig for cluster-to-tailnet name resolution |
 | `egress-forge.yaml` | Egress proxy for accessing forge on indri |
 | `secret.yaml.tpl` | 1Password template for OAuth credentials (manual) |
@@ -81,10 +81,10 @@ kubectl logs -n tailscale -l app.kubernetes.io/name=operator
 
 - **TODO:** The OAuth secret (`operator-oauth`) is not managed by ArgoCD and must be applied
   manually. Future improvement: integrate with a secrets operator (e.g., External Secrets).
-- Services using the Tailscale LoadBalancer must reference the ProxyClass:
+- Services using the Tailscale LoadBalancer should reference the ProxyClass:
   ```yaml
   annotations:
-    tailscale.com/proxy-class: "crio-compat"
+    tailscale.com/proxy-class: "default"
   ```
 - The egress proxy for forge targets `indri.tail8d86e.ts.net` directly (not `forge.tail8d86e.ts.net`)
   because Tailscale Serve hostnames are virtual and only work via the Tailscale client.

argocd/manifests/tailscale-operator/egress-forge.yaml

@@ -11,7 +11,7 @@ metadata:
   namespace: tailscale
   annotations:
     tailscale.com/tailnet-fqdn: indri.tail8d86e.ts.net
-    tailscale.com/proxy-class: "crio-compat"
+    tailscale.com/proxy-class: "default"
 spec:
   type: ExternalName
   externalName: placeholder

argocd/manifests/tailscale-operator/proxyclass.yaml

@@ -1,17 +1,11 @@
-# ProxyClass: crio-compat
+# ProxyClass: default
 #
-# Why this exists:
-# CRI-O (the container runtime used by minikube) cannot resolve short image
-# names like "tailscale/tailscale:stable". It requires fully-qualified names
-# with an explicit registry prefix (e.g., "docker.io/tailscale/tailscale:stable").
-#
-# The Tailscale operator creates proxy pods (StatefulSets) for each LoadBalancer
-# Service or Ingress. By default, these pods use short image names which fail
-# on CRI-O with "ImageInspectError".
+# Specifies fully-qualified image names for Tailscale proxy pods.
+# This ensures consistent behavior across different container runtimes.
 #
 # Usage:
 # Add this annotation to any Tailscale Service or Ingress:
-#   tailscale.com/proxy-class: "crio-compat"
+#   tailscale.com/proxy-class: "default"
 #
 # This tells the operator to use the fully-qualified image names defined below
 # when creating the proxy pod for that resource.
@@ -19,7 +13,7 @@
 apiVersion: tailscale.com/v1alpha1
 kind: ProxyClass
 metadata:
-  name: crio-compat
+  name: default
 spec:
   statefulSet:
     pod: