docs: update CLAUDE.md for device discovery

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -27,9 +27,13 @@ One login instead of logging into Proxmox, Zabbix, OMV, and every service separa
     server always runs a fixed read-only script regardless of what's exec'd, so a leaked key is still
     contained. See `docs/ssh-collector-key-setup.md`, including the gotcha that `diskPaths` in
     `hosts.yaml` must be kept in sync **by hand** with the remote script's `DISK_<label>=` lines.
-  - Everything else (network discovery, Zabbix alerts) is filed as backlog issues, not yet implemented.
+  - Everything else (Zabbix alerts) is filed as backlog issues, not yet implemented.
 - Auth: local (bcrypt + signed session cookie) is live. `AUTH_MODE=oidc` is a stubbed config value only —
   Authentik wiring is issue #12, not implemented.
+- **Device discovery** (done, separate from the collector system above — it's inventory, not per-host
+  metrics): `scripts/discover-devices.sh` runs via systemd timer **on the CT122 host**, not in Docker
+  (real ARP entries live in the host's network namespace, not Docker's bridge network). API reads the
+  resulting JSON each poll cycle. Full reasoning in `docs/device-discovery.md`.
 
 ## Infrastructure this project owns
 
@@ -47,7 +51,6 @@ One login instead of logging into Proxmox, Zabbix, OMV, and every service separa
 ## Known gaps / explicitly deferred (see issues for detail)
 
 - No historical charts yet — only the latest snapshot is shown (24h retention in SQLite unused by the UI so far).
-- No network device discovery yet.
 - No Zabbix/Graylog integration yet — this dashboard doesn't duplicate their alerting, just complements it later.
 - Public exposure and Authentik OIDC both need either credentials from the user or manual dashboard steps
   (Cloudflare Zero Trust, NPM admin UI, Authentik admin) — flagged in the relevant issues, not blocking.