Add VM configs, WireGuard, and MSP360 setup

- vm-configs/fstab/: fstab snapshots for JARVIS, NPM, NovaCPX, Jellyfin, MediaStack
- vm-configs/network-reference.md: full IP/service/NAS/WireGuard reference
- wireguard/: MediaStack wg0/wg1 and WireGuard CT nord0/wg-clients configs
- msp360/: install and setup scripts + staggered backup schedule

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X8tDRrQqgLjqXebMCBNcP3

wireguard/wgct-nord0.conf

@@ -0,0 +1,17 @@
+# WireGuard CT (LXC 110, 10.48.200.67) NordVPN tunnel config
+# Connects to NordVPN server at 2.56.190.66:51820 (Clouvider UK)
+# Policy routes 10.200.0.0/24 (MediaStack tunnel clients) through NordVPN
+# File: /etc/wireguard/nord0.conf
+
+[Interface]
+PrivateKey = Ebk+g1cMK14ured/u+QLvHPYxmoh9dCmeq65qbS/Aqg=
+Address = 10.5.0.2/32
+Table = off
+PostUp = sysctl -w net.ipv4.conf.all.rp_filter=0 || true; ip route add default dev nord0 table 201 || true; ip rule add from 10.200.0.0/24 lookup 201 prio 100 || true; iptables -t nat -A POSTROUTING -o nord0 -j MASQUERADE || true
+PostDown = ip route del default dev nord0 table 201 2>/dev/null; ip rule del from 10.200.0.0/24 lookup 201 2>/dev/null; iptables -t nat -D POSTROUTING -o nord0 -j MASQUERADE 2>/dev/null
+
+[Peer]
+PublicKey = 8pRFH/FfMBs3eBJCM2ABFoOs/13n78LYQvoovZVLdgI=
+Endpoint = 2.56.190.66:51820
+AllowedIPs = 0.0.0.0/0
+PersistentKeepalive = 25