fleet: register vm-esh-nas as 5th Docker host + canonical dockge stack

vm-esh-nas (10.0.50.154) is a NAS-adjacent Docker VM on the esh-pve-nas
hypervisor. Runs filezilla (port 5800), dockge, beszel-agent, dozzle-agent
with /mnt/{share,music,books,media} NFS-mounted from 10.0.50.50.
Use this host when a stack needs direct NFS mounts to the ESH NAS shares.

Canonicalize dockge as stacks/dockge/ — single compose used on all five
Docker hosts with per-host DOCKGE_HOST_LABEL/DOCKGE_HOST_IP in .env so
each card on the homepage points at its own instance. Labeled
homepage.group=Service Networking.

Beszel + Dozzle agent dirs also renamed to beszel-agent-<site> /
dozzle-agent-<site> pattern across the fleet for consistency.

stacks/dockge/.env.example

@@ -0,0 +1,23 @@
+# Dockge per-host tunables.
+#
+# Copy to .env on each host. Most defaults are fine; the HOST_LABEL and
+# HOST_IP are what the homepage card shows, so they must be set per-host.
+
+# Image pin (blank = latest)
+DOCKGE_VERSION=latest
+
+# Port on the host. Default matches the upstream docs.
+DOCKGE_PORT=5001
+
+# Human-readable host name for the homepage card, e.g.
+#   ana-docker, nh3-docker, esh-docker-vm, vm-esh-nas, ana-ml2
+DOCKGE_HOST_LABEL=
+
+# IP (or hostname) the browser uses to reach this Dockge. Used in
+# homepage.href — must be reachable from wherever you view homepage.
+#   ana-docker     → 10.250.50.70
+#   ana-ml2        → 10.250.50.54
+#   nh3-docker     → 10.100.50.40
+#   esh-docker-vm  → 10.0.50.45
+#   vm-esh-nas     → 10.0.50.154
+DOCKGE_HOST_IP=

stacks/dockge/README.md

@@ -0,0 +1,66 @@
+# dockge
+
+Per-host [Dockge](https://dockge.kuma.pet/) — a lightweight web UI for
+the compose files in `/opt/docker/compose/`. Runs one instance on every
+Docker host in the fleet.
+
+## Layout
+
+- `compose.yaml` — canonical, same file pushed to every host
+- `.env.example` — per-host tunables; `DOCKGE_HOST_LABEL` + `DOCKGE_HOST_IP` vary
+
+## Homepage
+
+Labeled `homepage.group=Service Networking` so all five Dockge instances
+collapse into the toolchain group on the dashboard, each card pointing
+at its own host's web UI.
+
+## Deploy
+
+```bash
+cp stacks/dockge/compose.yaml stacks-mirror/<host>/dockge/
+scripts/deploy-stack.sh <host> dockge --compose
+ssh -t <host> 'cd /opt/docker/compose/dockge && sudo docker compose up -d --force-recreate'
+```
+
+The `.env` with the correct `DOCKGE_HOST_LABEL` / `DOCKGE_HOST_IP` must
+exist on the host before the deploy — otherwise the homepage labels will
+render with empty substitutions. Initial seed per host:
+
+```bash
+# ana-docker
+ssh -t ana-docker 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=ana-docker
+DOCKGE_HOST_IP=10.250.50.70
+EOF'
+
+# ana-ml2
+ssh -t ana-ml2 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=ana-ml2
+DOCKGE_HOST_IP=10.250.50.54
+EOF'
+
+# nh3-docker
+ssh -t nh3-docker 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=nh3-docker
+DOCKGE_HOST_IP=10.100.50.40
+EOF'
+
+# esh-docker-vm
+ssh -t esh-docker-vm 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=esh-docker-vm
+DOCKGE_HOST_IP=10.0.50.45
+EOF'
+
+# vm-esh-nas
+ssh -t vm-esh-nas 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=vm-esh-nas
+DOCKGE_HOST_IP=10.0.50.154
+EOF'
+```
+
+## Authoritative vs mirror
+
+Per-host `.env` lives on the server and is gitignored.
+`compose.yaml` is authoritative in `stacks/dockge/` and gets promoted
+into `stacks-mirror/<host>/dockge/` before each deploy.

stacks/dockge/compose.yaml

@@ -0,0 +1,37 @@
+# Dockge — per-host Docker Compose UI (https://dockge.kuma.pet/).
+#
+# One instance runs on every Docker host so the compose dir is manageable
+# from a browser. Each host sets DOCKGE_HOST_LABEL + DOCKGE_HOST_IP in its
+# .env so the homepage card points at the right place.
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  dockge:
+    image: louislam/dockge:${DOCKGE_VERSION:-latest}
+    container_name: dockge
+    restart: unless-stopped
+    ports:
+      - "${DOCKGE_PORT:-5001}:5001"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - dockge_data:/app/data
+      - /opt/docker:/opt/docker
+    environment:
+      - DOCKGE_STACKS_DIR=/opt/docker/compose
+    networks:
+      - tnet
+    labels:
+      - homepage.group=Service Networking
+      - homepage.name=Dockge (${DOCKGE_HOST_LABEL})
+      - homepage.icon=si-portainer
+      - homepage.description=Compose UI on ${DOCKGE_HOST_LABEL}
+      - homepage.href=http://${DOCKGE_HOST_IP}:${DOCKGE_PORT:-5001}
+
+volumes:
+  dockge_data:
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true