homepage: function-first layout + fleet label sweep

Reorganize the gethomepage dashboard from site-based (PFI-ANA, ESH, NH3)
to function-first grouping (Monitoring, AI Systems, Apps, Media, Games,
Infra-<site>, Service Networking). Canonical config now tracked in
configs/homepage/ with Plex/Jellyfin widget keys moved to env
substitution.

Label sweep across fleet compose files:
  - beszel, dozzle, backrest -> Monitoring
  - rest-server-ana -> Service Networking

Healthcheck fixes (previous wget/curl paths broke on distroless +
--private-repos 401):
  - beszel hub:    /beszel health --url ...
  - beszel agent:  /agent health (newly added)
  - rest-server:   nc -z localhost 8000 (TCP probe)

Group name originally "Wiring / Plumbing" collapsed to single-word group
on homepage's parser; renamed to "Service Networking" everywhere.

stacks/backrest/compose.yaml

@@ -42,7 +42,7 @@ services:
     networks:
       - tnet
     labels:
-      - homepage.group=PFI-ANA
+      - homepage.group=Monitoring
       - homepage.name=Backrest
       - homepage.icon=mdi-backup-restore
       - homepage.description=Restic snapshot viewer / restore UI

stacks/beszel/compose.yaml

@@ -6,7 +6,8 @@
 # Multi-host layout via compose profiles:
 #   COMPOSE_PROFILES=hub          → hub only        (ana-docker)
 #   COMPOSE_PROFILES=hub,agent    → hub + local agent on the same host
-#   COMPOSE_PROFILES=agent        → agent only      (ana-ml2)
+#   COMPOSE_PROFILES=agent        → agent only      (ana-ml2, nh3-docker,
+#                                                    esh-docker-vm, vm-esh-nas)
 #
 # The agent uses network_mode: host so it sees real host CPU/mem/net/disk
 # counters rather than container-scoped ones — that's why it can't share
@@ -25,15 +26,17 @@ services:
     volumes:
       - beszel_data:/beszel_data
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:8090/api/health"]
-      interval: 30s
+      # Hub image is distroless — no wget/curl. Use the bundled `/beszel`
+      # binary's built-in health subcommand (https://beszel.dev/guide/healthchecks).
+      test: ["CMD", "/beszel", "health", "--url", "http://localhost:8090"]
+      interval: 120s
       timeout: 10s
       retries: 3
       start_period: 15s
     networks:
       - tnet
     labels:
-      - homepage.group=PFI-ANA
+      - homepage.group=Monitoring
       - homepage.name=Beszel
       - homepage.icon=mdi-chart-line
       - homepage.description=Server + container monitoring
@@ -49,9 +52,25 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - beszel_agent_data:/var/lib/beszel-agent
     environment:
+      # Agent auth has two modes (v0.13+ supports both side-by-side):
+      #   - KEY-mode: agent listens, hub connects inbound over SSH using KEY.
+      #     Requires BESZEL_HUB_KEY in .env.
+      #   - Token-mode: agent initiates an outbound connection to HUB_URL
+      #     using TOKEN. Easier through NAT. Requires HUB_URL + BESZEL_TOKEN.
+      # Leave unused ones empty ("") in .env; both can be set simultaneously.
       - PORT=${BESZEL_AGENT_PORT:-45876}
-      - KEY=${BESZEL_HUB_KEY}
+      - KEY=${BESZEL_HUB_KEY:-}
+      - HUB_URL=${HUB_URL:-}
+      - TOKEN=${BESZEL_TOKEN:-}
       - EXTRA_FILESYSTEMS=${BESZEL_EXTRA_FS:-}
+    healthcheck:
+      # Agent image ships the `/agent` binary with a `health` subcommand.
+      # Verifies the agent process is up — not that the hub can reach it.
+      test: ["CMD", "/agent", "health"]
+      interval: 120s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
 
 volumes:
   beszel_data:

stacks/dozzle/compose.yaml

@@ -34,7 +34,7 @@ services:
     networks:
       - tnet
     labels:
-      - homepage.group=PFI-ANA
+      - homepage.group=Monitoring
       - homepage.name=Dozzle
       - homepage.icon=mdi-text-box-search
       - homepage.description=Container logs (ana-docker + ana-ml2)

stacks/rest-server-ana/compose.yaml

@@ -40,7 +40,11 @@ services:
       - OPTIONS=--private-repos --append-only --prometheus ${EXTRA_OPTIONS:-}
       - TZ=${TZ:-America/Los_Angeles}
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:8000/metrics >/dev/null 2>&1 || [ $? -eq 6 ] && exit 0 || exit 1"]
+      # TCP port probe — busybox nc ships in the restic/rest-server Alpine
+      # image. HTTP-level checks fight with --private-repos returning 401
+      # (busybox wget exit 8, gnu wget exit 6 — version-dependent and hard
+      # to branch on cleanly in POSIX sh).
+      test: ["CMD", "nc", "-z", "localhost", "8000"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -48,7 +52,7 @@ services:
     networks:
       - tnet
     labels:
-      - homepage.group=PFI-ANA
+      - homepage.group=Service Networking
       - homepage.name=Restic (rest-server)
       - homepage.icon=mdi-cloud-upload
       - homepage.description=Anaheim restic endpoint (data on NFS)

stacks/rest-server-nh3/compose.yaml

@@ -33,7 +33,9 @@ services:
     # automatically — no extra bind mount needed as long as the htpasswd
     # file is created inside DATA_DIR before startup.
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:8000/metrics >/dev/null || exit 1"]
+      # TCP port probe — avoids the --private-repos 401 trap.
+      # See stacks/rest-server-ana/compose.yaml for reasoning.
+      test: ["CMD", "nc", "-z", "localhost", "8000"]
       interval: 30s
       timeout: 10s
       retries: 3