VLAN Phase 1: Infrastructure ready (filtering not yet enabled)

Created without disruption:
- 6 VLANs (10,20,30,35,40,50) on bridge
- DHCP pools and servers for each VLAN
- Inter-VLAN firewall rules
- WiFi SSIDs: Home-Trusted, Home-IoT, Home-Guest
- Legacy 192.168.31.0/24 still active

Next: Enable VLAN filtering to activate segmentation

docs/00-CHANGELOG.md

@@ -102,3 +102,17 @@ For detailed history before 2026-01-17, see archived changelogs:
   - IP: 172.17.0.3/24 on veth-tailscale
   - State persisted to usb1/tailscale/state
   - Userspace mode enabled
+
+## 2026-01-25 (VLAN Implementation)
+- [VLAN] Created VLAN interfaces on bridge:
+  - VLAN 10: Management (192.168.10.0/24)
+  - VLAN 20: Trusted (192.168.20.0/24)
+  - VLAN 30: IoT (192.168.30.0/24)
+  - VLAN 35: Cameras (192.168.35.0/24)
+  - VLAN 40: Servers (192.168.40.0/24)
+  - VLAN 50: Guest (192.168.50.0/24)
+- [VLAN] DHCP servers configured for all VLANs
+- [VLAN] Inter-VLAN firewall rules created
+- [VLAN] WiFi SSIDs created: Home-Trusted, Home-IoT, Home-Guest
+- [STATUS] VLAN filtering NOT yet enabled (Phase 1 complete)
+- [NOTE] Legacy 192.168.31.0/24 still active for transition