docs: Sync Fern docs for recent changes

[kfelternv]

What this PR does

Correct docs/manuals/vpc/flat_vpcs_zero_dpu.md to reflect the
nico-admin-cli network-segment create subcommand. The guide previously stated
that no such subcommand existed and that runtime HostInband segment creation
required calling the CreateNetworkSegment gRPC endpoint directly.

The updated page now gives operators the real CLI command and the required
host-inband inputs.

Source PRs reviewed

Reviewed the 80 PRs merged in NVIDIA/infra-controller between 2026-07-02 and
2026-07-09. This docs change is driven by:

• feat(cli): Support network segment creation from CLI #3143 feat(cli): Support network segment creation from CLI (adds
  network-segment create).

Considered but not requiring a docs edit here: #3145 (vpc create on the admin
CLI; the guide's nicocli coverage-gap note is about the tenant REST wrapper,
not the admin CLI) and #3150 (REST endpoint restructure; the OpenAPI spec is
regenerated in-PR and no prose docs reference the old routes).

How we verified it

Tested revision cdd338a5a2a2f119e5aaeb401d5e3980a3a03421 from a clean
checkout on macOS 26.5.1 arm64 with the repository-pinned Rust 1.96.0 toolchain
and Node.js 25.5.0.

Hands-on verification:

• Compiled and ran
  cargo run --package nico-admin-cli -- network-segment create --help.
  The real help output listed host-inband as a --segment-type value,
  showed --gateway as optional, and exposed --name, --prefix, and
  --subdomain-id. The command's runtime dispatch requires the global
  --cloud-unsafe-op acknowledgment, whose help explicitly warns against
  production use.
• Started the local Fern preview with the repository-pinned
  fern-api@4.81.0 package. The changed page returned HTTP 200 and rendered
  the restart-applied TOML/runtime CLI distinction, the required
  --cloud-unsafe-op=<username> warning, conditional --gateway guidance,
  and the 2-configuring-hostinband-network-segments section anchor. The
  stale "no create command" and mandatory-gateway wording were absent.

Supporting checks:

• fern check: 0 errors.
• rumdl 0.2.29 reported the same seven pre-existing MD040/MD029 findings on
  both origin/main and the PR revision; the edited region added no finding.
• git diff --check origin/main...HEAD: passed.
• fern docs broken-links --strict still reports 27 pre-existing errors in
  other pages; none are in the changed Flat VPC page.

How to reproduce the verification

Prerequisites: macOS arm64, Rustup, Node.js/npm, and rg.

git clone https://github.com/kfelternv/infra-controller.git
cd infra-controller
git checkout cdd338a5a2a2f119e5aaeb401d5e3980a3a03421

CARGO_TERM_COLOR=never NO_COLOR=1 \
  cargo run --package nico-admin-cli -- network-segment create --help

Expected CLI checkpoints:

• --segment-type lists host-inband.
• Help includes --name, --prefix, --gateway, and --subdomain-id;
  --gateway is not part of the required usage set.
• nico-admin-cli --help documents --cloud-unsafe-op <USERNAME> and its
  non-production warning.

Validate and render the documentation:

npx -y fern-api@4.81.0 check
npx -y fern-api@4.81.0 docs dev --port 4173

In another shell:

URL=http://127.0.0.1:4173/infra-controller/documentation/operations-day-2/managing-vp-cs/flat-vp-cs-and-zero-dpu-hosts

curl -sSL -o /dev/null -w '%{http_code}\n' "$URL"
curl -sSL "$URL" | rg -o -F -- 'Restart-applied TOML'
curl -sSL "$URL" | rg -o -F -- 'cloud-unsafe-op'
curl -sSL "$URL" | rg -o -F -- 'must not be used against a production site'
curl -sSL "$URL" | rg -o -F -- 'add <code>--gateway</code> when the IPv4 prefix has a gateway'
curl -sSL "$URL" | rg -o -F -- 'id="2-configuring-hostinband-network-segments"'

Expected result: HTTP 200 and one match from each content check.

Risk / notes

• Docs-only change; no code or generated specs touched.
• Possible follow-up (out of scope): docs/playbooks/force_delete.md still uses
  the old -c API-URL flag in one example; docs: correct nico-admin-cli API URL flag from -c to -a #3114 renamed it to -a everywhere
  else. A separate one-line fix.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Walkthrough

The VPC manual now documents nico-admin-cli network-segment create as the runtime path for adding HostInband segments, including the required flags and --cloud-unsafe-op, while keeping show and delete guidance.

Changes

HostInband Runtime Documentation

Layer / File(s)	Summary
Document CLI segment creation docs/manuals/vpc/flat_vpcs_zero_dpu.md	The operations matrix and Day 1+ workflow now describe runtime creation through nico-admin-cli network-segment create, including the required HostInband options, --subdomain-id, and --cloud-unsafe-op.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is related to the docs change, but it is too generic to identify the actual update.	Rename it to mention the host-inband network-segment docs and the new nico-admin-cli create command.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description matches the docs-only change and accurately explains the new nico-admin-cli guidance.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pull-request-3306.docs.buildwithfern.com/infra-controller

[github-actions]

🔍 Container Scan Summary

No Grype artifacts were found to aggregate.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/manuals/vpc/flat_vpcs_zero_dpu.md`:
- Line 75: The “Create an additional HostInband segment after Day 0” row in the
runtime-only table is mixing a restart-based path with a post-Day-0 workflow.
Update the markdown so the `TOML ([networks]) + API restart` option is moved
back to the Day-0 section or removed from this row, and keep only the
runtime-safe `nico-admin-cli` path here. Check the surrounding HostInband
segment guidance and the “Configuring HostInband Network Segments” reference to
keep the table consistent.
- Around line 200-206: The HostInband CLI description makes --gateway sound
required, but the command only enforces --subdomain-id and treats --gateway as
optional. Update the nico-admin-cli network-segment create wording to describe
--gateway as conditional/optional for HostInband segments, and keep the rest of
the flag guidance aligned with the command contract and help text.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c344b1c0-e499-44e3-befe-6d200980da6e

📥 Commits

Reviewing files that changed from the base of the PR and between c5ede1e and a26f7d1.

📒 Files selected for processing (1)

• docs/manuals/vpc/flat_vpcs_zero_dpu.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a26f7d1803

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".