blog: heroes belong in frontmatter - fix the five new posts

The five carried the hero only as an inline markdown image, but the index
cards and the post hero figure render from hero/heroAlt frontmatter - so
the cards showed no image and the post pages lost the hero treatment.
Moved each hero into frontmatter and dropped the inline line (the body
keeps only the diagram), matching every earlier post.

src/content/blog/clone-not-keys.md

@@ -4,10 +4,10 @@ date: 2026-08-02
 summary: "A browser IDE you can reach from the couch or a phone is a legitimate want — and the obvious build, hosting it where the keys already live, quietly parks the whole estate behind a browser tab. Price the stolen session first, then hand the new surface copies of everything and originals of nothing, so the worst case is a git revert instead of a lost fleet."
 tags: ["security", "developer-experience", "sso", "kubernetes", "homelab"]
 draft: false
+hero: "/blog/clone-not-keys.webp"
+heroAlt: "A luminous reading room of copied pages, thin circuit traces running back to a sealed vault where the original documents rest untouched"
 ---
 
-![A luminous reading room of copied pages, thin circuit traces running back to a sealed vault where the original documents rest untouched](/blog/clone-not-keys.webp)
-
 You want your development environment everywhere. VS Code in a browser tab, reachable from the couch on the LAN and from a phone across the mesh VPN, with git and the daily tooling already inside. It's a legitimate want — it's how odd half-hours turn into finished work.
 
 And the first instinct is obvious: host it on the operator box. That machine already has everything — every repo cloned, every context wired, every login warm. One container, one hostname, done by the weekend.

src/content/blog/landing-on-cilium.md

@@ -4,10 +4,10 @@ date: 2026-08-02
 summary: "Nobody chose our network stack — it accreted one default at a time, and every component was one more thing to version, patch, debug and alert on. Landing on Cilium wasn't an adoption; it was a demolition schedule, and the stack left standing is smaller than the one we started with."
 tags: ["cilium", "kubernetes", "networking", "architecture", "homelab"]
 draft: false
+hero: "/blog/landing-on-cilium.webp"
+heroAlt: "An accreted house of circuit-traced extensions dissolves into particles, leaving one clean glowing frame standing"
 ---
 
-![An accreted house of circuit-traced extensions dissolves into particles, leaving one clean glowing frame standing](/blog/landing-on-cilium.webp)
-
 Ask why the fleet ran flannel and there was never an answer worth writing down. Nobody chose it. Talos bundles flannel, so flannel ran. Kubernetes ships kube-proxy, so kube-proxy ran. LoadBalancer services need something on the LAN to answer for their addresses, so MetalLB moved in. HTTP needed terminating, so ingress-nginx went up, and later Traefik replaced it — on one cluster, Traefik still answers on ingress-nginx's old IP, the fossil of a hop nobody remembers deciding.
 
 That's how most platform stacks are built. Not designed — accreted, the way an old house grows. A lean-to here, a carport there, each extension the quickest answer to the question of the day. And every extension arrives with its own roofline: a version to pin, a changelog to read, failure modes to learn, alerts to write.

src/content/blog/one-doorman-many-doors.md

@@ -4,10 +4,10 @@ date: 2026-08-02
 summary: "When an app grows a human face on an interface machines also depend on, one auth layer over everything either breaks the machines or quietly weakens the human door to let them through. The pattern that holds: a single identity-provider proxy in front of every human door, while machine paths keep their own scoped credentials — route by audience, not by app."
 tags: ["security", "sso", "authentik", "kubernetes", "homelab"]
 draft: false
+hero: "/blog/one-doorman-many-doors.webp"
+heroAlt: "A glowing reception desk in a dark circuit-lined lobby signs streams of visitor light through many doors, while courier light-trails slip through keyed loading docks around the building's edge"
 ---
 
-![A glowing reception desk in a dark circuit-lined lobby signs streams of visitor light through many doors, while courier light-trails slip through keyed loading docks around the building's edge](/blog/one-doorman-many-doors.webp)
-
 Sooner or later, a machine-facing service grows a human face. The container registry every node in the fleet pulls from ships a web UI. The development environment becomes a browser tab with a live terminal in it. Now there are people arriving at hostnames that machines also depend on — and the tempting move is one auth layer over the whole thing. Put the entire host behind single sign-on. One rule, no exceptions, done.
 
 Do that to a registry and the cluster stops pulling images the same afternoon, because a container runtime cannot answer an interactive login page. The failure after that one is quieter and worse: you see the machines breaking, so you loosen the layer to let them through — an exception here, an anonymous path there — until the human door is weaker *because* the machines needed in.

src/content/blog/sleep-half-the-fleet.md

@@ -4,10 +4,10 @@ date: 2026-08-02
 summary: "Three of this fleet's six machines were upgraded, verified healthy, and then deliberately shut down the same night — and the books record a state, not a failure. When a node's entire existence is a rebuildable document, powered off becomes something you schedule, not something you fear."
 tags: ["homelab", "operations", "talos", "sustainability", "architecture"]
 draft: false
+hero: "/blog/sleep-half-the-fleet.webp"
+heroAlt: "A dark tower of circuit-traced architecture at night — most windows unlit and resting, a few glowing where the core still works"
 ---
 
-![A dark tower of circuit-traced architecture at night — most windows unlit and resting, a few glowing where the core still works](/blog/sleep-half-the-fleet.webp)
-
 Homelabs run 24/7 out of habit. The habit comes with a scoreboard — `uptime` counters climbing into the
 hundreds of days, worn as proof of seriousness — and with two feelings nobody says out loud: the guilt of
 turning a server off, as if a dark machine means you weren't serious; and the quieter fear that if you do

src/content/blog/stage-the-locks.md

@@ -4,10 +4,10 @@ date: 2026-08-02
 summary: "Turning off anonymous pulls on the registry a fleet boots from is a change that only fails at the next boot — and a node that can't pull at boot may not come back to tell you. So the flip is split in time: the credential staged inert in every node's config, each node rebooted and proven with a real pull, and the door closed only when the last key has turned."
 tags: ["security", "registry", "kubernetes", "talos", "homelab"]
 draft: false
+hero: "/blog/stage-the-locks.webp"
+heroAlt: "A corridor of doors propped open, new lock cylinders and freshly cut keys glowing on a locksmith's bench — every lock staged, none yet turned"
 ---
 
-![A corridor of doors propped open, new lock cylinders and freshly cut keys glowing on a locksmith's bench — every lock staged, none yet turned](/blog/stage-the-locks.webp)
-
 Every node in this fleet pulls its images through one registry: a pull-through mirror fronting five upstreams behind a single host. Anonymous read has been on since the day it went up — the bootstrap-era convenience you stop noticing, right up until you write the words *production posture* and realise the registry the entire estate boots from will hand an image to anyone who asks. The fix is not exotic: a named pull identity for the fleet, anonymous off.
 
 And the reflex for shipping a fix like that is the reflex that works for everything else. Make the change, watch it, roll it back if it misbehaves. Flip the policy, delete a pod, watch the pod re-pull. Green means done.