Add n8n workflows 01-08 (with upgrades), 14-16; planning docs; .gitignore

docs/troubleshooting/KNOWN_QUIRKS.md

@@ -4,6 +4,15 @@ Per-service gotchas that aren't bugs but will bite you if you forget them.
 
 ## PlausibleDeniability
 
+### n8n workflow 16 (NFS Watchdog)
+- Runs `sudo docker restart` and `sudo bash .../mount-unraid-nfs.sh` over SSH from n8n container
+- Requires a NOPASSWD sudoers rule or SSH commands will hang waiting for a password:
+  ```
+  truenas_admin ALL=(ALL) NOPASSWD: /usr/bin/docker, /bin/bash /mnt/tank/docker/scripts/mount-unraid-nfs.sh
+  ```
+  Add via `sudo visudo -f /etc/sudoers.d/n8n-watchdog`
+- SSH credential in n8n must use key-based auth (see n8n-workflows/README.md for keygen steps)
+
 ### immich-ml
 - Healthcheck has no curl/wget — uses `/proc/net/tcp6` pattern
 - Cache goes to `/mnt/docker-ssd/docker/appdata/immich-ml` (separate from immich-server's appdata)