cluster config is an HA option (sm121_config_extra), not a second repo

Simplification: the private cluster-config repo was over-complicated. The
cluster config ([[clusters]]/nccl with the private IPs, [home_assistant],
[mikrotik], [registry]) is pasted into the sm121_config_extra add-on
option (raw TOML appended to the generated config) — HA option storage is
private and on the Pi. No second repo, no PAT. Verified: the launcher
config (minus the ssh fields) as the option → 16 clusters in the
generated config → live /api/state shows the clusters. Docs + spec
addendum follow.

AGENTS.md

@@ -803,13 +803,12 @@ token is required) with a background re-sync loop
 (`SM121_REPO_RESYNC_MINUTES`). Its `custom_components/` custom-integration
 prototype is superseded (entities are a phase-2 nicety over the add-on's
 REST API). The cluster definitions (private IPs — never in the public
-recipe repo) come from a **private** `sm121/cluster-config` git repo,
-fetched at boot via the `sm121_base_config` (+ `sm121_base_config_token`)
-options and used as the base config (it may carry `[home_assistant]` /
-`[mikrotik]` — a private repo can hold cluster-side secrets). Per-install
-credentials that can't be flat options (e.g. a `[mikrotik]` block with its
-password) can also go in the `sm121_config_extra` option — raw TOML
-appended to the generated config, kept out of the log.
+recipe repo) are supplied as the **`sm121_config_extra` add-on option**
+(raw TOML, appended to the generated config): `[[clusters]]`/nccl +
+`[home_assistant]` + `[mikrotik]` live in HA's own option storage —
+private, on the Pi, no second repo, no PAT. If that TOML carries
+`[home_assistant]`/`[registry]`, the matching flat options must stay
+empty (duplicate TOML tables fail the parse).
 
 **Single-launcher rule** — the per-recipe run ledger (`.lock` in the
 recipe repo) is the serialization point: a second launcher that serves

specs/tech-architecture/ha-addon-recipe-repos.md

@@ -237,3 +237,15 @@ never logged) and used as the base config. Being private, that repo may
 carry the cluster-side secrets (`[home_assistant]` token,
 `[mikrotik]` password). The public recipe repo carries only
 `recipes/` + `docker-images/`.
+
+## Addendum (2026-10-11, 3rd): cluster config as an HA option (simplification)
+
+The private `cluster-config` repo was dropped as over-complicated. The
+cluster config (`[[clusters]]`/nccl with the private IPs,
+`[home_assistant]`, `[mikrotik]`, `[registry]`) is supplied as the
+**`sm121_config_extra` add-on option** — raw TOML appended verbatim to
+the generated config. HA option storage is private and lives on the Pi,
+so the public recipe repo stays config-free without a second repo or a
+PAT. Caveat: if that TOML carries `[home_assistant]`/`[registry]`, the
+matching flat options (`sm121_ha_url`/`token`, `sm121_registry_base`)
+must stay empty — duplicate TOML tables fail the parse.