Add Gandi DNS docs and rewrite homepage intro (#115)

## Summary
- New reference card (`docs/reference/infrastructure/gandi.md`) covering DNS records, Pulumi config, TLS integration
- New how-to guide (`docs/how-to/gandi-operations.md`) for DNS deployment and PAT cycling with `pbpaste` shortcut
- Rewritten homepage intro for wider audience ahead of public docs.eblu.me
- Cross-linked from reference index, routing, caddy, and how-to index
- Fixed PAT expiration inaccuracy in `pulumi/gandi/README.md` (max is 90 days, not 30)

## Test plan
- [ ] Verify wiki-links resolve in Quartz build
- [ ] Review gandi reference card for accuracy
- [ ] Review gandi-operations how-to for accuracy
- [ ] Check homepage reads well for external visitors

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/115

docs/reference/infrastructure/gandi.md

@@ -0,0 +1,67 @@
+---
+title: gandi
+tags:
+  - infrastructure
+  - networking
+  - dns
+---
+
+# Gandi
+
+DNS hosting provider for the `eblu.me` domain, managed via Pulumi IaC.
+
+## Quick Reference
+
+| Property | Value |
+|----------|-------|
+| **Domain** | `eblu.me` |
+| **Provider** | Gandi LiveDNS |
+| **IaC** | `pulumi/gandi/` |
+| **Stack** | `eblu-me` |
+
+## What It Does
+
+Gandi hosts the DNS records that make `*.ops.eblu.me` resolve to [[indri]]'s Tailscale IP (100.98.163.89). Since Tailscale IPs are not publicly routable, this gives services real DNS names while keeping them private to the tailnet.
+
+The target IP is resolved dynamically from `indri.tail8d86e.ts.net` at deploy time, so if indri's Tailscale IP changes, re-running the deployment is sufficient.
+
+## DNS Records
+
+| Record | Type | Value | TTL |
+|--------|------|-------|-----|
+| `*.ops.eblu.me` | A | indri's Tailscale IP | 300s |
+| `ops.eblu.me` | A | indri's Tailscale IP | 300s |
+
+Both records point to [[indri]], which runs [[caddy]] as the reverse proxy for all services. See [[routing]] for the full service URL map.
+
+## Pulumi Configuration
+
+The Pulumi program lives in `pulumi/gandi/`:
+
+- `__main__.py` - Creates the two A records via `pulumiverse_gandi`
+- `Pulumi.eblu-me.yaml` - Stack config (domain, subdomain)
+
+Stack config values:
+
+| Key | Value |
+|-----|-------|
+| `blumeops-dns:domain` | `eblu.me` |
+| `blumeops-dns:subdomain` | `ops` |
+
+A break-glass override is available via the `BLUMEOPS_REVERSE_PROXY_IP` environment variable, which bypasses dynamic IP resolution.
+
+## TLS Integration
+
+[[caddy]] uses Gandi's API separately (via `GANDI_BEARER_TOKEN`) for ACME DNS-01 challenges to obtain a wildcard Let's Encrypt certificate for `*.ops.eblu.me`. This is a different credential from the Pulumi PAT.
+
+## Authentication
+
+Gandi requires a Personal Access Token (PAT) for API access. PATs have a maximum lifetime of 90 days (currently set to 30). See [[gandi-operations]] for deployment and PAT cycling instructions.
+
+## Related
+
+- [[gandi-operations]] - PAT cycling and deployment how-to
+- [[routing]] - Service URLs and routing architecture
+- [[caddy]] - Reverse proxy using Gandi for TLS
+- [[tailscale]] - Tailnet networking
+- [[indri]] - Server hosting Caddy (DNS target)