docs: Add agent guidance and sync Rancher docs

README.md

@@ -11,7 +11,7 @@ Production-ready Kubernetes cluster on Hetzner Cloud using Terraform and Ansible
 | **Total Cost** | €28.93/mo |
 | **K8s** | k3s (latest, HA) |
 | **Addons** | Hetzner CCM + CSI + Prometheus + Grafana + Loki |
-| **Access** | SSH/API restricted to Tailnet |
+| **Access** | SSH/API and Rancher UI restricted to Tailnet |
 | **Bootstrap** | Terraform + Ansible |
 
 ### Cluster Resources
@@ -239,6 +239,12 @@ Terraform/bootstrap secrets remain in Gitea Actions secrets and are not managed
 - Ansible is limited to cluster bootstrap, private-access setup, and prerequisite secret creation for Flux-managed addons.
 - `addon-flux-ui` is optional for the stable-baseline phase and is not a blocker for rebuild success.
 
+### Rancher access
+
+- Rancher is private-only and exposed through Tailscale at `https://rancher.silverside-gopher.ts.net/dashboard/`.
+- The public Hetzner load balancer path is not used for Rancher.
+- Rancher uses the CNPG-backed PostgreSQL cluster in `cnpg-cluster`.
+
 ### Stable baseline acceptance
 
 A rebuild is considered successful only when all of the following pass without manual intervention: