Initial project documentation: NVR Shield — Reolink NVR monitoring agent

- README: project overview, pricing, deployment model
- ARCHITECTURE: system design, data flow, components, security
- DECISIONS: Pi Zero 2W, Tailscale, reolink-aio, Wasabi S3 choices
- ROADMAP: 3-phase plan (MVP, monetization, expansion)
- CHANGELOG: concept (Aug 1) and full documentation (Aug 5)
- Customer onboarding information request sheet

DECISIONS.md

@@ -0,0 +1,55 @@
+# NVR Shield — Decisions
+
+## Why Pi Zero 2W?
+
+- **Cost:** $15/unit keeps BOM at ~$41, enabling $149 retail with healthy margin
+- **Power:** 5V micro-USB, can share NVR's UPS or any USB port
+- **Size:** Tiny, fits behind NVR or in structured media panel
+- **OS:** Raspberry Pi OS Lite (Bookworm) — mature, read-only overlayfs support, Tailscale package
+
+**Alternatives considered:**
+- Pi 4/5: Overkill. 4x the cost, no benefit for API polling workload
+- ESP32: Too constrained. No Python, limited HTTP client, no Tailscale
+- On-NVR agent: Reolink NVRs don't support custom agents. Would require rooting
+
+## Why Tailscale Instead of Direct VPN?
+
+- Zero customer firewall configuration needed — Tailscale punches through NAT
+- Pre-configured at flash time, ships ready to connect
+- Tag-based ACLs (`tag:nvr-shield`) keep devices isolated from rest of tailnet
+- Customer never sees or manages the VPN
+
+## Why reolink-aio Library?
+
+- Active open-source Python client for Reolink cameras/NVRs
+- Supports both HTTP and HTTPS API
+- Handles login/session management
+- Maintained, documented, tested against Reolink firmware
+
+**Alternative:** Direct HTTP calls with `requests`. Rejected — reolink-aio handles auth, errors, and data parsing.
+
+## Why One Pi Per Site (Not Per NVR)?
+
+- Single Pi Zero 2W can poll 5-10 NVRs with zero performance issues (lightweight HTTP calls, no video)
+- Simplifies deployment: one device per physical location
+- Cleaner pricing: per-site, not per-NVR
+- Reduces BOM for multi-NVR sites
+
+## Why Core Dashboard on :8090?
+
+- Existing Ops Portal runs on :8090. NVR Shield is a natural extension
+- Shares auth (central auth JWT validation)
+- Path-based routing: `/nvr-shield/` sits alongside existing `/backup-restore/`, `/ops/`
+
+## Why Wasabi S3?
+
+- Already used for all ITPP backups (hermes, app1, app2, app3)
+- No egress fees for clip retrieval/viewing
+- Per-bucket IAM policies for customer isolation
+- Immutability for compliance/audit trail
+
+## Pricing Decisions
+
+- Hardware at $149: 3.6x BOM ($41) — covers labor (flashing, packaging, shipping), still competitive with off-the-shelf NVR monitoring appliances ($200-500)
+- Monthly tiers: $49 (monitoring) / $97 (clip vault) / $147 (AI rules) — follows ITPP convention: annual = monthly, simple increments
+- No per-NVR surcharge: cleaner pitch, fewer objections