dockge: parameterize stacks-root path + deploy on corviduo-dev

Made the host-stacks bind-mount path configurable via
DOCKGE_HOST_STACKS_ROOT (default /opt/docker, unchanged for the
existing five hosts). Override on corviduo-dev to /home/vh/docker
because that host's /opt/ is owned by deploy:deploy (Worldtree team)
and vh lacks passwordless sudo for the fleet-standard path — same
reasoning as the beszel + dozzle agent placement earlier today.

Deployed to corviduo-dev. Reachable at http://10.250.50.152:5001
(first probe 200 — Docker's port-mapping route through iptables
worked without firewall changes, unlike beszel's network_mode: host).

Scoped to PFI-managed stacks only (/home/vh/docker/compose/) — does
NOT see /opt/worldtree*/ deployments. Keeps the management boundary
clean: dockge can restart/recreate PFI's beszel+dozzle+itself but
not the Worldtree-team-owned containers.

servers/corviduo-dev/README.md

@@ -68,6 +68,7 @@ future infra-ops sessions find them.
 |---|---|---|
 | `/home/vh/docker/compose/beszel/` | `beszel-agent` (host port 45876, `network_mode: host`) | Agent for the Beszel hub at ana-docker:8090. Hub SSH-polls inbound using the seeded ed25519 pubkey. |
 | `/home/vh/docker/compose/dozzle-agent/` | `dozzle-agent` (host port 7007) | Agent for the Dozzle hub at ana-docker:8088. Hub connects inbound over mTLS (auto-generated certs on first run). |
+| `/home/vh/docker/compose/dockge/` | `dockge` (host port 5001) | Per-host compose UI. Scoped to PFI-managed stacks under `/home/vh/docker/compose/` — does NOT see `/opt/worldtree*/` (worldtree-team boundary). `DOCKGE_HOST_STACKS_ROOT=/home/vh/docker` overrides the fleet-default `/opt/docker`. |
 
 The empty `traefik-net` external docker network was created on this host as
 a side effect of dozzle-agent's compose (which declares it external). Future

stacks/dockge/.env.example

@@ -20,4 +20,13 @@ DOCKGE_HOST_LABEL=
 #   nh3-docker     → 10.100.50.40
 #   esh-docker-vm  → 10.0.50.45
 #   vm-esh-nas     → 10.0.50.154
+#   corviduo-dev   → 10.250.50.152
 DOCKGE_HOST_IP=
+
+# Host directory containing the per-stack compose dirs. Default
+# /opt/docker matches the fleet convention. Override only for hosts
+# where /opt/docker isn't writable / appropriate.
+#   corviduo-dev   → /home/vh/docker
+# Trailing slash NOT required. Dockge sees the .../compose/ subdir
+# as its stacks root (DOCKGE_STACKS_DIR derives from this).
+DOCKGE_HOST_STACKS_ROOT=/opt/docker

stacks/dockge/README.md

@@ -1,9 +1,15 @@
 # dockge
 
 Per-host [Dockge](https://dockge.kuma.pet/) — a lightweight web UI for
-the compose files in `/opt/docker/compose/`. Runs one instance on every
+managing the host's docker compose stacks. Runs one instance on every
 Docker host in the fleet.
 
+Default stacks root is `/opt/docker/compose/` (fleet convention).
+Hosts where `/opt/docker/` isn't writable by the deploying user
+override `DOCKGE_HOST_STACKS_ROOT` in their `.env` — corviduo-dev
+sets it to `/home/vh/docker` (vh lacks passwordless sudo on the
+worldtree-team-managed host; see `servers/corviduo-dev/README.md`).
+
 ## Layout
 
 - `compose.yaml` — canonical, same file pushed to every host

stacks/dockge/compose.yaml

@@ -16,9 +16,14 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - dockge_data:/app/data
-      - /opt/docker:/opt/docker
+      # Bind-mount the host's stacks root at the same path inside the
+      # container. Default /opt/docker matches the fleet convention;
+      # corviduo-dev overrides to /home/vh/docker because PFI's standard
+      # /opt/docker path is sudo-gated by deploy:deploy there and vh
+      # lacks passwordless sudo. See servers/corviduo-dev/README.md.
+      - ${DOCKGE_HOST_STACKS_ROOT:-/opt/docker}:${DOCKGE_HOST_STACKS_ROOT:-/opt/docker}
     environment:
-      - DOCKGE_STACKS_DIR=/opt/docker/compose
+      - DOCKGE_STACKS_DIR=${DOCKGE_HOST_STACKS_ROOT:-/opt/docker}/compose
     networks:
       - tnet
     labels: