servers/psmf: add psmf server docs, nginx/tailscale config, and data-sync

Document the psmf host (DNS, second tailscale netns instance, nginx
vhosts, migration plan) and add the docker-dev-22 psmf-data-sync
service plus the storage-23 pg_hba.conf entry it needs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

servers/psmf/tailscale-second-instance.md

@@ -0,0 +1,39 @@
+```bash
+# Create namespace
+sudo ip netns add ts2
+
+# veth pair: host side <-> ns side
+sudo ip link add veth-ts2 type veth peer name veth-ts2-ns
+sudo ip link set veth-ts2-ns netns ts2
+
+# Host side
+sudo ip addr add 10.200.0.1/30 dev veth-ts2
+sudo ip link set veth-ts2 up
+
+# Namespace side
+sudo ip -n ts2 addr add 10.200.0.2/30 dev veth-ts2-ns
+sudo ip -n ts2 link set veth-ts2-ns up
+sudo ip -n ts2 link set lo up
+sudo ip -n ts2 route add default via 10.200.0.1
+
+# DNS inside the netns
+sudo mkdir -p /etc/netns/ts2
+echo "nameserver 1.1.1.1" | sudo tee /etc/netns/ts2/resolv.conf
+
+# NAT from the netns out to the world (replace eth0 with your egress iface)
+sudo sysctl -w net.ipv4.ip_forward=1
+sudo iptables -t nat -A POSTROUTING -s 10.200.0.0/30 -o br0 -j MASQUERADE
+sudo iptables -A FORWARD -i veth-ts2 -o br0 -j ACCEPT
+sudo iptables -A FORWARD -o veth-ts2 -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+
+# quick sanity check
+sudo ip netns exec ts2 curl https://controlplane.tailscale.com
+# expect: "OK"
+```
+
+```bash
+# ts2 alias
+echo 'alias ts2="sudo ip netns exec ts2 tailscale --socket=/run/tailscale-ts2/tailscaled.sock"' \
+  | sudo tee /etc/profile.d/tailscale-ts2.sh
+```