homepage: function-first layout + fleet label sweep

Reorganize the gethomepage dashboard from site-based (PFI-ANA, ESH, NH3)
to function-first grouping (Monitoring, AI Systems, Apps, Media, Games,
Infra-<site>, Service Networking). Canonical config now tracked in
configs/homepage/ with Plex/Jellyfin widget keys moved to env
substitution.

Label sweep across fleet compose files:
  - beszel, dozzle, backrest -> Monitoring
  - rest-server-ana -> Service Networking

Healthcheck fixes (previous wget/curl paths broke on distroless +
--private-repos 401):
  - beszel hub:    /beszel health --url ...
  - beszel agent:  /agent health (newly added)
  - rest-server:   nc -z localhost 8000 (TCP probe)

Group name originally "Wiring / Plumbing" collapsed to single-word group
on homepage's parser; renamed to "Service Networking" everywhere.

stacks/rest-server-ana/compose.yaml

@@ -40,7 +40,11 @@ services:
       - OPTIONS=--private-repos --append-only --prometheus ${EXTRA_OPTIONS:-}
       - TZ=${TZ:-America/Los_Angeles}
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:8000/metrics >/dev/null 2>&1 || [ $? -eq 6 ] && exit 0 || exit 1"]
+      # TCP port probe — busybox nc ships in the restic/rest-server Alpine
+      # image. HTTP-level checks fight with --private-repos returning 401
+      # (busybox wget exit 8, gnu wget exit 6 — version-dependent and hard
+      # to branch on cleanly in POSIX sh).
+      test: ["CMD", "nc", "-z", "localhost", "8000"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -48,7 +52,7 @@ services:
     networks:
       - tnet
     labels:
-      - homepage.group=PFI-ANA
+      - homepage.group=Service Networking
       - homepage.name=Restic (rest-server)
       - homepage.icon=mdi-cloud-upload
       - homepage.description=Anaheim restic endpoint (data on NFS)