feat(homepage): recategorise on "do I open this?", collapse the API groups

The board mixed tools with endpoints. A vLLM seat whose href is a /docs page
sat in the same band as ComfyUI; the MQTT broker and the RustDesk relay, which
have no page at all, sat in Apps; and `Service Networking` was thirteen members
spanning three AdGuards, five Dockges, two Traefiks and four headless agents.

Every group is now one of two kinds and they never mix. TOOLS are expanded and
sit at the top of their tab. ENDPOINTS — an API, a broker, a background agent,
an href that is /docs or /ping or nothing — carry `initiallyCollapsed: true`
and sit at the bottom. Collapsed is not hidden: the eyebrow and its rule still
render, so the tab still says the thing exists and one click expands it.

A second rule fell out of the same pass and now shapes the group boundaries: a
group's members should all carry a widget or none should. A stat strip makes a
card ~50px taller, so one widget card in a row of plain ones opens a void under
the plain ones. That is why AdGuard and Traefik get their own groups rather
than sharing one with Dockge, and it is most of why the old Service Networking
band looked broken. AdGuard (ANA) was the last short card in its row and now
carries the same query/blocked/latency strip as its two siblings — one
infra-ops AdGuard login authenticates against all three instances, verified
against each; it lives in that stack's .env on the host and is vaulted.

The sixteen GPU-backed model seats were deliberately NOT relabelled.
`homepage.group` is read at container creation, so clearer names for
`AI - Inference` and friends would have cost a recreate on six vLLM seats, four
eval seats and four TTS engines — multi-minute model reloads on endpoints peers
reach through the gateway. Order plus `initiallyCollapsed` buys the same
separation for nothing, so those names stay as they are on purpose.

28 containers that ARE cheap to bounce were relabelled, across five hosts, via
rerunnable elway playbooks. Their label steps are gated on the old value still
being present, so a second run reports skipped rather than churning. Two verify
steps were wrong on first contact and are fixed with the reason recorded: the
traefik check raced its own recreate, and asserting a model seat is "running"
cannot answer "did I bounce it" when a seat may be legitimately stopped —
container age can, and now does.

The canonical stacks/ tree was synced to the deployed labels afterwards, so
intent and reality agree again on all fourteen tracked stacks.

Also documents the real nature of the post-recreate blank dashboard, which cost
~25 minutes here and an hour on 2026-08-19. `initialSettings":{}` in the served
HTML is the catch branch of the page's data loader, not a warm-up and not a
cache — and the error can vanish entirely, because the logger is assigned inside
the same try and the catch only logs if the logger exists. Ruled out by
measurement this time: all four API routes return 200 with correct content while
the page serves {}, and the previous known-good settings.yaml reproduces it
identically. The README now carries the one-command test and the next lead.

Before/after, all four tabs: http://10.100.10.50:8090/b/homepage-relayout/

persistent-memory.d/2026-08-24-homepage-uniform-grid.md

@@ -116,3 +116,97 @@ The Main tab still opens on three sparse bands: **Notes** (1 member) and
 News, or folding Games into Apps, would tighten the top of the page — but that
 is information architecture, not layout, and the group names are the operator's.
 Surfaced rather than done.
+
+→ **Resolved in pass 2 below**, where the operator delegated the naming
+("re-categorize however you want"). Notes + News became `Daily`, Games folded
+into `Apps`, and the `AI - Audio Tools` placement in this pass was superseded
+(Scriberr moved on to `AI - Studios`).
+
+---
+
+# `[2026-08-24, pass 2]` Recategorised on "do I open this?", API groups collapsed
+
+Operator, after seeing pass 1: *"You can re-categorize however you want.
+service networking tab is uneven, you can split out the adguard cards, etc.
+most of the issues are that tools I use and have a UI are interspersed with API
+endpoints which are largely informational only. They might even go in their own
+cards or start collapsed."*
+
+## The axis
+
+Every group is now either **tools** (expanded, top of tab) or **endpoints** (an
+API, a broker, an agent — `initiallyCollapsed: true`, bottom of tab). A
+collapsed group still renders its eyebrow and rule, so presence costs one line
+instead of two rows.
+
+Second, quieter rule that fell out of the same pass: **a group's members should
+all carry a widget or none should.** A stat strip adds ~50px, so one widget card
+in a row of plain ones opens a void under the plain ones — which is most of what
+made the 13-member `Service Networking` band look broken.
+
+## Shape
+
+- **Main** — `Daily` (Memos, Miniflux, Nevermore, SearXNG — replaces the
+  1-card Notes and 2-card News bands), `Monitoring`, `Apps` (12; absorbed the
+  1-card `Games` band), `Media`, `UltraSeedbox`.
+- **AI** — `AI - Gateways & Chat` (8) and `AI - Studios` (6) expanded; then
+  `AI - Inference` (7), `AI - Eval & Retrieval` (4), `AI - Speech (TTS)` (4),
+  `AI - Audio Tools` (2), `AI - Dormant` (6) all collapsed.
+- **Toolchain** — `DNS & Filtering` (3), `Reverse Proxies` (2),
+  `Compose Consoles` (5), `Toolchain` (3), `Agents (no UI)` (6, collapsed).
+- **Infrastructure** — unchanged; every card there is already a console.
+
+Measured after: every group `card=360`, and `DNS & Filtering` and
+`Reverse Proxies` both `h=134..134` — dead flush.
+
+## ⚠ The move that made it affordable
+
+**The sixteen GPU-backed model seats were NOT relabelled.** `homepage.group` is
+read at container **creation**, so renaming `AI - Inference` to something
+clearer would have meant recreating six vLLM seats plus four eval seats plus
+four TTS engines — multi-minute model reloads on endpoints peers reach through
+the gateway. Order plus `initiallyCollapsed` buys the same separation for free,
+so the names stay ugly on purpose. **Do not spend that recreate on a label.**
+
+28 containers *were* relabelled — all cheap web services — via five rerunnable
+elway playbooks, `playbooks/homepage-regroup-<host>.yaml`. The canonical
+`stacks/` tree was synced to match afterwards, so intent and reality agree.
+
+`initiallyCollapsed: true` is a per-group key in `layout:`; confirmed present in
+this build (`defaultOpen: !(group?.initiallyCollapsed ?? global)` in
+`/app/.next/server/pages/index.js`).
+
+## AdGuard (ANA) gained its widget, and the credential is fleet-wide
+
+It was the only AdGuard without a query/blocked/latency strip, so it sat short
+beside two tall siblings. **One `infra-ops` AdGuard login authenticates against
+all three instances** (ANA `:8053`, NH3 `:8080`, ESH `:8080` — all returned 200
+on `POST /control/login`, verified 2026-08-24). Vaulted at
+`secret get nh3-dev/adguard-infra-ops-password`; written to
+`/opt/docker/compose/adguard-ana/.env` (0600, root) and never into git. Its icon
+was also the odd one out (`mdi-dns` against two `si-adguard`).
+
+## ⚠⚠ `initialSettings":{}` — the tab-bar mystery is a SWALLOWED EXCEPTION
+
+The biggest durable finding of the day, and it cost ~25 minutes. Full write-up
+in `stacks/homepage/README.md`; the short version:
+
+`initialSettings":{}` in the served HTML is **the catch branch** of the page's
+data loader, not a warm-up and not a cache. And the error can vanish without
+trace: the logger is assigned as the first statement *inside* the same `try`,
+and the `catch` only logs `if (logger)`. If the logger is what threw, nothing is
+written anywhere — which is exactly what was observed.
+
+Ruled out by measurement, do not re-run: `/api/services`, `/api/bookmarks`,
+`/api/widgets` and `/api/hash` all return **200 with correct content** while the
+page serves `{}`; restoring the previous known-good `settings.yaml` reproduces
+it identically; `/api/validate` returns `[]`; disk and permissions are fine.
+
+**One-command test:**
+`curl -s http://10.0.50.45:5100/ | grep -o 'initialSettings":[^,]\{0,20\}'`
+
+**What broke the streak:** three consecutive recreates came up empty, then
+rolling the 8.6 MB `conf/homepage/logs/homepage.log` aside and recreating healed
+it within 15 seconds. That is one observation, not proof — but it is a coherent
+mechanism (oversized log → logger init throws → silent catch) and it is the
+cheapest thing to try first next time.