Plan and build the NAS on VLAN 40 #95

ADR-0008 places media services on VLAN 40 (CasaBonita) on a new N100-class NAS —
Jellyfin and Plex, in the low-trust tier, separated from the sensitive-tier
services by data trust rather than by function.

The roadmap carries this as one line ("Plan and build the NAS on VLAN 40"); the
ADR carries the reasoning and the placement. This issue is the two together.

What it needs before hardware

• Capacity: how much storage, and what redundancy. This is the first machine
  in the estate holding data whose loss would actually matter.
• The firewall rule. ADR-0008 adds 50→40, taking the estate from three
  inter-VLAN rules to four. Every rule is meant to be directional and
  documented; this one needs writing down before it is created, not after.
• Where the backups go. Currently nothing in the estate has an off-host
  backup target, which is also blocking the firewall-config copy and the volume
  backups.

VLAN 40 is currently terminal — egress only, no path inward. Adding a NAS
changes what "terminal" means for that segment, and that is the part worth
thinking about before ordering anything.

Tracked in docs/roadmap.md; filed as an issue so it has a place to be discussed and closed.