docs: update infrastructure state and roadmap

docs/AI_CONTEXT.md

@@ -28,6 +28,11 @@ Public IP: 51.255.83.140
 * BaGet
 * Gitea Actions Runner (`silverlinux-runner`)
 * DbGate
+* Xray
+* Prometheus
+* Grafana
+* Node Exporter
+* cAdvisor
 
 ## Domains
 
@@ -43,6 +48,8 @@ nuget.silveressence.net -> BaGet (through Nginx Proxy Manager)
 
 dbgate.silveressence.net -> DbGate (through Nginx Proxy Manager)
 
+Xray -> Public tunneling endpoint through proxy network
+
 ## Secrets
 
 Secrets are stored in:
@@ -57,9 +64,14 @@ Always use env_file.
 
 proxy
 internal
+jitsi-docker-jitsi-meet-aa76415_meet.jitsi
+xray_default
+gitea-runner_default
 
 MSSQL is attached only to `internal`. DbGate is attached to both `internal` and `proxy`.
 
+Jitsi uses `jitsi-docker-jitsi-meet-aa76415_meet.jitsi` for its internal cluster and `proxy` for web access. Xray is currently attached to `proxy`; `xray_default` exists but had no running containers attached in the 2026-06-24 runtime snapshot.
+
 ## Authentication
 
 Gitea:
@@ -91,6 +103,53 @@ MSSQL uses hostname `mssql` on the `internal` Docker network. Port 1433 is not p
 
 DbGate provides authenticated HTTPS administration for MSSQL and PostgreSQL at `https://dbgate.silveressence.net`.
 
+Xray is a connectivity layer, not an application backend. It runs from `ghcr.io/xtls/xray-core:latest` and publishes `0.0.0.0:32443 -> 8080/tcp`. Its endpoint exposure and access policy should be reviewed during security checks.
+
+## Monitoring
+
+The monitoring stack is operational.
+
+Components:
+
+* Prometheus
+* Grafana
+* Node Exporter
+* cAdvisor
+
+Validated:
+
+* Prometheus UI
+* Prometheus targets
+* Node Exporter
+* cAdvisor
+* Backup metrics
+* Grafana datasource
+
+Grafana has custom backup, system and Docker monitoring dashboards.
+
+## Backup
+
+Backup v2 is operational.
+
+Implemented:
+
+* Daily cron backup
+* HTML reports
+* Email reports through Postfix and Gmail SMTP
+* Automatic archive generation
+* Automatic cleanup
+* Prometheus metrics export
+* Restore validation
+
+Verified:
+
+* PostgreSQL
+* MSSQL
+* Gitea
+* BaGet
+* OpenProject assets
+* Docker configuration
+
 ## Documentation
 
 Read all files in:
@@ -99,6 +158,20 @@ docs/
 
 and the README.md of each service folder before making infrastructure recommendations.
 
+Roadmap:
+
+* Phase 1 completed: Grafana, Prometheus, Node Exporter, cAdvisor, backup metrics integration
+* Phase 1 remaining: Loki, Redis, Authelia
+* Phase 2 completed: Backup v2 automation, restore validation
+* Phase 2 remaining: CrowdSec, Sentry, Fail2Ban upgrade, Cloudflare rate limiting and WAF
+* Phase 3: SonarQube, Harbor, Backstage, Nextcloud
+
+See:
+
+```text
+docs/roadmap.md
+```
+
 ## Important Decisions
 
 * Plane.so removed
@@ -110,3 +183,5 @@ and the README.md of each service folder before making infrastructure recommenda
 * Gitea Actions and a global self-hosted runner selected for package publishing
 * MSSQL Express deployed alongside PostgreSQL
 * DbGate selected as the database administration portal
+* Xray introduced as a tunneling and connectivity layer
+* Multi-network segmentation formalized: internal, proxy and isolated infrastructure networks