corviduo-dev: deploy beszel + dozzle monitoring agents

Operator-approved fleet monitoring extension. Both agents up + healthy:
- beszel-agent on host port 45876 (KEY-mode, hub at ana-docker:8090
  SSH-polls inbound; seeded with hub's ed25519 pubkey).
- dozzle-agent on host port 7007 (mTLS auto-generated; hub at
  ana-docker:8088 connects inbound).

Compose lives at /home/vh/docker/compose/{beszel,dozzle-agent}/ rather
than the fleet-standard /opt/docker/compose/{...}/ because corviduo-dev's
/opt/ is owned by deploy:deploy (Worldtree team) and vh lacks
passwordless sudo to create the fleet path. Functionally identical;
documented in servers/corviduo-dev/README.md so future infra-ops
sessions find them.

Created an empty traefik-net external docker network on corviduo-dev
as a side effect of dozzle-agent's compose (which declares it external).
Future PFI services landing here can reuse it.

Dozzle hub on ana-docker had 10.250.50.152:7007 appended to
DOZZLE_REMOTE_AGENT (a host-side change to a non-tracked .env, not
canonical). Beszel hub still needs corviduo-dev added via the UI's
"Add System" action — one-time operator step, flagged in the corviduo
README.

servers/corviduo-dev/README.md

@@ -38,6 +38,8 @@ to over the LAN.
 
 ## Deployments
 
+### Worldtree (Worldtree-team-managed, under `/opt/`)
+
 Three `docker compose` projects under `/opt/`:
 
 | Project dir | Container name | Role |
@@ -54,6 +56,29 @@ The image is pulled from `gitea.phasefinal.com/vh/worldtree`, SHA-pinned
 per deploy after Worldtree's CI workflow commit `8ef3801` (health-gated
 `:latest` advance — `:latest` only moves on successful `/health` probes).
 
+### PFI monitoring agents (infra-ops-managed, under `/home/vh/`)
+
+Bootstrap 2026-05-24. Live at `/home/vh/docker/compose/{beszel,dozzle-agent}/`,
+**not** under `/opt/docker/compose/` — corviduo-dev's `/opt/` is owned by
+`deploy:deploy` (Worldtree team) and `vh` lacks passwordless sudo to
+create the fleet-standard path. Functionally identical; documented here so
+future infra-ops sessions find them.
+
+| Project dir | Container | Role |
+|---|---|---|
+| `/home/vh/docker/compose/beszel/` | `beszel-agent` (host port 45876, `network_mode: host`) | Agent for the Beszel hub at ana-docker:8090. Hub SSH-polls inbound using the seeded ed25519 pubkey. |
+| `/home/vh/docker/compose/dozzle-agent/` | `dozzle-agent` (host port 7007) | Agent for the Dozzle hub at ana-docker:8088. Hub connects inbound over mTLS (auto-generated certs on first run). |
+
+The empty `traefik-net` external docker network was created on this host as
+a side effect of dozzle-agent's compose (which declares it external). Future
+PFI services landing here can reuse it.
+
+After bootstrap, the dozzle hub's `.env` on ana-docker had `10.250.50.152:7007`
+appended to `DOZZLE_REMOTE_AGENT` and was force-recreated. The beszel hub
+needs corviduo-dev added via the **"Add System"** UI action (host=10.250.50.152
+port=45876) — pure-API equivalent uses pocketbase admin auth which we didn't
+script. One-time operator step.
+
 ## Permissions model + the docker-as-root pattern
 
 `vh` is the SSH user for ops. **`vh` does NOT have passwordless sudo.**

stacks/beszel/README.md

@@ -6,6 +6,7 @@ Lightweight monitoring — CPU, memory, disk, network, and per-container stats f
 - **ana-docker** (hub + local agent) — UI at `http://10.250.50.70:8090`
 - **ana-ml2** (agent only) — listens on `10.250.50.54:45876`
 - **nh3-docker** (agent only, cross-site) — listens on `10.100.50.40:45876`
+- **corviduo-dev** (agent only) — listens on `10.250.50.152:45876`. Compose at `/home/vh/docker/compose/beszel/` (not `/opt/docker/compose/` — see `servers/corviduo-dev/README.md` for why)
 
 Same compose.yaml on each host. Per-host `.env` sets `COMPOSE_PROFILES` to bring up the right combination. Each agent host is added individually in the hub UI.
 

stacks/dozzle/README.md

@@ -6,6 +6,7 @@ Container log viewer. One UI on **ana-docker** aggregates logs from every Docker
 - **ana-docker** (hub) — UI at `http://10.250.50.70:8088`
 - **ana-ml2** (agent) — listens on `10.250.50.54:7007`
 - **nh3-docker** (agent, cross-site) — listens on `10.100.50.40:7007`
+- **corviduo-dev** (agent) — listens on `10.250.50.152:7007`. Compose at `/home/vh/docker/compose/dozzle-agent/` (not `/opt/docker/compose/` — see `servers/corviduo-dev/README.md` for why)
 
 One compose.yaml lives on each host. The per-host `.env` sets `COMPOSE_PROFILES=hub` or `COMPOSE_PROFILES=agent` so `docker compose up -d` brings up the right service. On the hub, add every agent to `DOZZLE_REMOTE_AGENT` as a comma-separated list (e.g. `10.250.50.54:7007,10.100.50.40:7007`).