docs(reference): import Dune: Awakening server-manager references

Phase 2 references for the host-agent Dune adapter, moved out of volatile /tmp
into docs/reference-repos/ (per Commander). Three upstream projects, .git +
node_modules + compiled binaries stripped (16MB source). Nested AI-instruction
files (.claude/, CLAUDE.md) removed so they don't pollute Corrosion sessions.

- icehunter/    dune-admin (Go+React) — 4 control planes; SETUP_DOCKER.md is the
                closest analog to our agent's Dune docker control plane (compose
                lifecycle, docker logs, RabbitMQ-via-exec, dune Postgres schema)
- adainrivers/  Rust/Tauri desktop — SSH+k8s BattleGroup control, maintenance
                daemon, in-game admin console (Rust idiom reference)
- the4rchangel/ Node web UI replacing battlegroup.bat — matches the Commander's
                Hyper-V self-host path + game-config schema

See docs/reference-repos/README.md for the full index + how we use each.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/reference-repos/adainrivers/crates/dune-server-service/systemd/dune-server-service.service

@@ -0,0 +1,35 @@
+[Unit]
+Description=Dune server management service (Rust)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/opt/dune-server-service/dune-server-service
+Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/dune/.local/bin"
+Environment="DUNE_DASHBOARD_PORT=29187"
+Environment="DUNE_SERVICE_HOME=/home/dune"
+EnvironmentFile=-/etc/dune-server-service.env
+Restart=on-failure
+RestartSec=10
+User=dune
+Group=dune
+
+ReadWritePaths=/home/dune/.dune /home/dune/.local /home/dune/.steam /home/dune/Steam /tmp -/funcom/artifacts/database-dumps
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=read-only
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+NoNewPrivileges=false
+MemoryDenyWriteExecute=false
+# steamcmd's bundled 32-bit steamclient.so requires writable text relocations
+# (dlmopen -> mprotect PROT_WRITE). Keep MemoryDenyWriteExecute explicitly
+# disabled so scheduled update checks can run under systemd.
+
+[Install]
+WantedBy=multi-user.target