homepage: function-first layout + fleet label sweep

Reorganize the gethomepage dashboard from site-based (PFI-ANA, ESH, NH3)
to function-first grouping (Monitoring, AI Systems, Apps, Media, Games,
Infra-<site>, Service Networking). Canonical config now tracked in
configs/homepage/ with Plex/Jellyfin widget keys moved to env
substitution.

Label sweep across fleet compose files:
  - beszel, dozzle, backrest -> Monitoring
  - rest-server-ana -> Service Networking

Healthcheck fixes (previous wget/curl paths broke on distroless +
--private-repos 401):
  - beszel hub:    /beszel health --url ...
  - beszel agent:  /agent health (newly added)
  - rest-server:   nc -z localhost 8000 (TCP probe)

Group name originally "Wiring / Plumbing" collapsed to single-word group
on homepage's parser; renamed to "Service Networking" everywhere.

configs/homepage/docker.yaml

@@ -0,0 +1,31 @@
+---
+# https://gethomepage.dev/latest/configs/docker/
+#
+# All four Docker hosts expose the engine on port 2375. This is plaintext
+# and works fine on a trusted LAN; if any host is ever exposed or shared,
+# switch to a TLS socket (examples commented below).
+
+esh-vm-docker:
+  host: 10.0.50.45
+  port: 2375
+
+ana-pfi-docker:
+  host: 10.250.50.70
+  port: 2375
+
+nh3-pfi-docker:
+  host: 10.100.50.40
+  port: 2375
+
+ana-ml2-docker:
+  host: 10.250.50.54
+  port: 2375
+
+# Example TLS socket (if/when a host moves off plaintext 2375):
+# ana-pfi-docker:
+#   host: 10.250.50.70
+#   port: 2376
+#   tls:
+#     keyFile: docker-tls/ana-docker/key.pem
+#     caFile:  docker-tls/ana-docker/ca.pem
+#     certFile: docker-tls/ana-docker/cert.pem