Document network operations and WireGuard maintenance

hosts/ubnt.md

@@ -25,6 +25,7 @@ Verify a changed key out of band before accepting it.
 | Image | `jacobalberty/unifi:v9.5.21` |
 | Network mode | host |
 | HTTPS UI | `https://192.168.66.46:8443` |
+| Device inform endpoint | `http://192.168.66.46:9080/inform` |
 
 The controller binds `*:8443`. A local HTTPS request to
 `https://127.0.0.1:8443/` is the primary quick health check.
@@ -43,6 +44,14 @@ Without this bypass, a controller request to `localhost:8443` can be sent to
 the OpenClash gateway instead of remaining local. Details and verification are
 in [the UniFi localhost proxy note](../docs/unifi-openclash-localhost.md).
 
+## Managed access points
+
+The controller manages the APs listed in [the UniFi network record](../docs/unifi-network.md).
+The inform endpoint is deliberately on port `9080`, not UniFi's common default
+of `8080`. During adoption or recovery, use the documented `:9080/inform` URL;
+an AP left on `:8080` can remain reachable by ping and SSH while showing
+offline in the controller.
+
 ## Safe reconciliation and verification
 
 ```bash
@@ -55,4 +64,3 @@ curl -k -sS -o /dev/null -w '%{http_code}\n' https://127.0.0.1:8443/
 
 Recreating the service briefly interrupts the controller. Do not use `docker
 compose down -v`; it can remove persistent data.
-