feat(egress): fleet SOCKS5 residential egress on nh3-scale (100.64.0.1:1080), successor to the retired nh3-dev danted; yt-voice-clipper repointed and back up

- scripts/setup-nh3-scale-socks-egress.sh: dante-server on CT107, mesh+fleet ACL only,
  After=tailscaled + Restart=on-failure; run via pct push/exec on nh3-pve
- YTVC_PROXY on irv-ml1 -> socks5h://100.64.0.1:1080 (override, untracked); worker recreated;
  end-to-end job verified with proxied/direct controls
- YTVC Homepage href/siteMonitor -> irv-ml1.nh3.internal:8000 (was the dead wg0 IP)

scripts/setup-nh3-scale-socks-egress.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# nh3-scale (CT107): SOCKS5 egress proxy over the mesh — fleet-internal only.
+# Successor to the retired nh3-dev danted (2026-09-06): same residential NH3 egress,
+# now hosted ON the exit-node router so mesh peers reach it at 100.64.0.1:1080.
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+dpkg -s dante-server >/dev/null 2>&1 || { apt-get update -qq; apt-get install -y -qq dante-server; }
+cat > /etc/danted.conf <<'CONF'
+# Fleet egress proxy on nh3-scale (PFI infra) — SOCKS5, INTERNAL-ONLY.
+# Egress via NH3's residential line. Managed from eshpfi-management
+# (scripts/setup-nh3-scale-socks-egress.sh) — edit there, not here.
+logoutput: syslog
+internal: 0.0.0.0 port = 1080
+external: eth0
+socksmethod: none
+clientmethod: none
+user.privileged: root
+user.unprivileged: nobody
+# Client ACL — mesh + fleet RFC1918 only. NOT an open proxy.
+client pass {
+    from: 100.64.0.0/10 to: 0.0.0.0/0
+    log: error
+}
+client pass {
+    from: 10.0.0.0/8 to: 0.0.0.0/0
+    log: error
+}
+client block {
+    from: 0.0.0.0/0 to: 0.0.0.0/0
+    log: connect error
+}
+socks pass {
+    from: 100.64.0.0/10 to: 0.0.0.0/0
+    protocol: tcp udp
+    log: error
+}
+socks pass {
+    from: 10.0.0.0/8 to: 0.0.0.0/0
+    protocol: tcp udp
+    log: error
+}
+socks block {
+    from: 0.0.0.0/0 to: 0.0.0.0/0
+}
+CONF
+mkdir -p /etc/systemd/system/danted.service.d
+cat > /etc/systemd/system/danted.service.d/override.conf <<'UNIT'
+[Unit]
+After=network-online.target tailscaled.service
+Wants=network-online.target
+[Service]
+Restart=on-failure
+RestartSec=5
+UNIT
+systemctl daemon-reload
+systemctl enable --now danted
+systemctl restart danted
+sleep 1
+systemctl is-active danted
+ss -ltn | grep ":1080 "