Karakeep: the second new app through the checklist — template, record, fixture, first ladder step 0.33.1 -> 0.33.2

Bookmarks/articles/notes with a crawler (karakeep-chrome) and search (meilisearch v1.41.0). AI off unless the household
enters a key; setup gate + sign-up closed twice; Chrome healthcheck over bash /dev/tcp; smtp_mapping (plaintext), mail-off
boot measured; web memory 768M -> 1536M on measurements (bench watch, box crawl burst). onboarding/karakeep.md complete.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,17 @@
+## Karakeep — the second app through the new-app checklist (2026-10-01, evening)
+
+- **`templates/karakeep/`** — bookmarks, articles, notes (formerly Hoarder): `ghcr.io/karakeep-app/karakeep:0.33.2` +
+  `karakeep-chrome:151.0.7922.47-r1` (the crawler's browser) + `getmeili/meilisearch:v1.41.0` (as upstream's compose).
+  AI tagging OFF unless the household enters an OpenAI key at install (the field says what that sends where); release
+  check off; meilisearch analytics off. First admin class 4: setup gate, then sign-up closed twice (`after_setup` →
+  `DISABLE_SIGNUPS`, and a case-insensitive block of `/signup` + any tRPC call naming `users.create`, batched too).
+  Chrome has no wget/curl, so its healthcheck asks DevTools over bash's /dev/tcp. App-email by `smtp_mapping`
+  (plaintext :2526); mail OFF boots (measured).
+- **Memory measured into the definition:** web 768M → 79 % in the bench watch; 1024M → 51 %, but real crawls on the box
+  reached 80.3 %; **1536M** → a 10-page burst peaked at 54 %. mem_limit 2816M.
+- First ladder step 0.33.1 -> 0.33.2 proven on the bench (swap 0) and on 9202; remove + restore read back.
+- `onboarding/karakeep.md`, fixture `Karakeep`, FIRST-ADMIN rows, README tables, Hungarian freeze.
+
 ## Radicale — the first app through the new-app checklist (2026-10-01, evening)
 
 - **`templates/radicale/`** — calendar and contacts (CalDAV/CardDAV), the Radicale project's own image