infra: harden xlab and skydick networking

skydick: read-only [torrents] SMB share + stale-doc fixes ...

Expose /srv/media/data (raw torrent payload) read-only & browseable to
@storage as \\SKYDICK\torrents, so every storage user can see the per-tracker
download tree and re-seed the same files without re-downloading. Seeding needs
only read access, so the share grants no write: door-pek's qBittorrent (uid
900), writing /srv/media over the rw,all_squash NFS export, stays the sole
writer. On-disk perms already permit @storage reads (payload 0640, dirs
0750/2775, group-readable by storage gid 997).

Docs:
- README: deploy-rs is the canonical push workflow (was "not consistently
  used"); skydick is bonded 2x40G ConnectX-3 / MTU 9200 (was "bonded 100G");
  IPv6 is enabled with stable token ::d1c0 (was the old enableIPv6=false gotcha).
- DATAPOOL.md: network header, new Torrents share row + "### Torrents" section
  with a re-seed runbook, connect examples, the remote door-pek writer note,
  and MTU 9200.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

add README — host roles + deploy + DNS gotchas