feat(homepage,dns): add WhereTF card + DNS alias; fix homepage docker discovery

WhereTF (operator-directed, brokkr-smithy-dev; nh3-dev:8093, user-systemd Bun
service): manual Homepage card under Apps (can't auto-discover) + DNS alias
wherethef.nh3.internal -> nh3-dev.

While adding the card, found Homepage's /api/services was hung (dashboard
degraded since the 2026-09-06 irv-ml1 move): its docker.yaml still pointed
irv-ml1 at the dead 10.100.79.3, and ana-ml2 (10.250.50.54:2375) is unreachable
from esh-docker-vm — either dead host hangs the whole aggregation on its TCP
connect timeout. Repointed irv-ml1 to 10.6.110.50 (verified reachable via mesh)
and disabled ana-ml2 (reversible, noted). /api/services now returns in 0s with
96 services; WhereTF renders.

dns/internal.yaml

@@ -118,5 +118,6 @@ aliases:
   - {name: searxng,   site: nh3, target: nh3-docker, note: moved off ana-docker 2026-09-03 — colo egress (38.120.12.42) is CAPTCHA-gated by search engines; NH3 egresses residentially}
   - {name: gateway,   site: ana, target: ana-docker, note: LiteLLM gateway :4000}
   - {name: booth,     site: nh3, target: nh3-dev,    note: The Booth :8090}
+  - {name: wherethef, site: nh3, target: nh3-dev,    note: WhereTF :8093}
   - {name: homepage,  site: esh, target: esh-docker-vm, note: fleet dashboard :5100}
   - {name: scriberr,  site: ana, target: ana-ml2,     note: transcription + diarization :8080 (GPU1)}

stacks/homepage/conf/docker.yaml

@@ -17,15 +17,20 @@ nh3-pfi-docker:
   host: 10.100.50.40
   port: 2375
 
-ana-ml2-docker:
-  host: 10.250.50.54
-  port: 2375
+# ana-ml2-docker DISABLED 2026-09-07: 10.250.50.54:2375 is not reachable from
+# esh-docker-vm (docker API not exposed/listening — ana-docker 10.250.50.70:2375
+# on the SAME subnet IS reachable, so this is host-specific, not routing). A dead
+# host here hangs the entire /api/services aggregation until its TCP connect times
+# out. Re-enable once ana-ml2 exposes the docker API and it is reachable from ESH.
+# ana-ml2-docker:
+#   host: 10.250.50.54
+#   port: 2375
 
-# irv-ml1 — reachable ONLY via WireGuard tunnel, so docker auto-discovery
-# traffic traverses the tunnel. If WG drops, homepage will show irv-ml1
-# services as offline until reconnect.
+# irv-ml1 — moved 10.100.79.3 -> 10.6.110.50 on 2026-09-06 (headscale cutover;
+# the old wg0 tunnel IP is dormant and no longer answers). Reachable from
+# esh-docker-vm via the mesh (10.6.110.50:2375 verified OPEN 2026-09-07).
 irv-ml1-docker:
-  host: 10.100.79.3
+  host: 10.6.110.50
   port: 2375
 
 # Example TLS socket (if/when a host moves off plaintext 2375):

stacks/homepage/conf/services.yaml

@@ -27,6 +27,13 @@
       icon: mdi-filmstrip
       siteMonitor: http://10.100.10.50:8090/healthz
       description: Media drop + upload-for-pickup + the standing agent link board — nh3-dev, 24h TTL except kept boards
+  # Manual entry — WhereTF is a user-level systemd service on nh3-dev (Bun,
+  # like the Booth), so Homepage can't auto-discover it.
+  - WhereTF:
+      href: http://10.100.10.50:8093/
+      icon: mdi-magnify-scan
+      siteMonitor: http://10.100.10.50:8093/healthz
+      description: Photograph drawers; ask where the f X is, or where a new thing should go — nh3-dev, LAN only
   - The Henge:
       href: http://park.phasefinal.com:8420/
       icon: mdi-clipboard-check