docs: record unifi firewall enforcement and closeout

docs/architecture/NETWORKING_MODEL.md

@@ -1,7 +1,7 @@
 # Homelab Networking Model
 
 ## Physical Network
-- **Gear:** Unifi throughout
+- **Gear:** UniFi throughout
 - **Gateway / controller:** UDM Pro (`10.5.0.1`, WAN `69.166.182.157`)
 - **Core / access switching:**
   - USW-24-PoE (`10.5.0.10`)
@@ -9,12 +9,23 @@
 - **Wi-Fi access points:**
   - U7 Pro (`10.5.0.21`) — active
   - U6 LR (`10.5.0.20`) — currently disconnected in UniFi as of 2026-05-21
-- **Main LAN:** 10.5.1.x (Trusted VLAN)
-- **Management VLAN:** 10.5.0.x
-- **Other VLANs:** Cameras, Guest, IoT / Old IoT
+- **Management subnet:** `10.5.0.0/24`
+- **Trusted subnet:** `10.5.1.0/24` (VLAN 51)
+- **IoT subnet:** `10.5.10.0/24` (VLAN 510)
+- **Camera subnet:** `10.5.20.0/24` (VLAN 520)
+- **Servers subnet:** `10.5.30.0/24` (VLAN 30)
+- **Guest subnet:** `10.5.90.0/24` (VLAN 590)
+- **Legacy quarantine:** `192.168.1.0/24` (`Old IoT`, VLAN 2)
+- **UniFi policy zones:**
+  - `Internal` = Management + Trusted + Servers
+  - `Untrusted` = IoT + Camera + Old IoT
+  - `Hotspot` = Guest
+- **Current custom policy additions on top of UniFi defaults:**
+  - `Allow Internal to Untrusted`
+  - `Block Untrusted to Gateway Admin Surfaces` (blocks IoT/Camera/Old IoT access to the UDM Pro admin TCP ports while leaving DHCP/DNS/mDNS/internet behavior to the existing zone defaults)
 - **Serenity IP:** 10.5.30.5
 - **N.O.M.A.D. IP:** 10.5.30.7
-- **PlausibleDeniability:** 10.5.30.6 (static on LAN)
+- **PlausibleDeniability:** 10.5.30.6 (Servers VLAN)
 
 ## Remote Access
 - **Pangolin VPS + Newt:** Services exposed as subdomains via reverse proxy. Newt agents run on PD and N.O.M.A.D.