docs: record unifi firewall enforcement and closeout

dev/rackpeek/config.yaml

@@ -151,6 +151,13 @@ resources:
       UniFi gateway and controller.
       UniFi device name: UDM Pro - Old.
       WAN uplink currently active on eth9.
+      UniFi policy zones as of 2026-05-23:
+      - Internal = Management + Trusted + Servers
+      - Untrusted = IoT + Camera + Old IoT
+      - Hotspot = Guest
+      Custom hardening on top of UniFi defaults:
+      - Allow Internal to Untrusted
+      - Block Untrusted to Gateway Admin Surfaces
 
   - kind: Server
     name: unifi-usw-24-poe