feat(esh-matter): Matter server (matter.js 1.4.0) on a VLAN-90-only LXC for Home Assistant

For ha-dev (operator-approved 2026-09-26). CT 111 on esh-pve at 10.0.90.20:
Matter/Thread IPv6 (Echo ULA + RA route-information) is link-only, so the
server sits on esh-iot and HA reaches it over routed IPv4 ws :5580.
- playbooks/esh-matter-lxc.yaml: kernel RA (accept_ra=1,
  rt_info_max_plen=64), forwarding off, Docker ip-forward/iptables off;
  nftables admits 5580 from HA 10.0.50.46 only and SSH from mgmt ranges;
  the CT is added to esh-pve's vzdump job (fabric credentials).
- stacks/matter-server: ghcr.io/matter-js/matterjs-server:1.4.0 (digest),
  host networking, /data on the CT.
- Acceptance: fdad:: SLAAC, ping6 thermostat, 2 Thread RIO routes learned, ws
  server_info from inside the HA container; 5580 refused from 10.0.50.45,
  nh3-dev and a temporary VLAN 90 netns vantage.

dns/internal.yaml

@@ -101,6 +101,7 @@ hosts:
   - {name: esh-pve-nas,      site: esh, v4: 10.0.50.55,     note: Proxmox hypervisor — storage/media}
   - {name: esh-vm-db,        site: esh, v4: 10.0.50.60,     note: PostgreSQL + MongoDB}
   - {name: esh-ml1,          site: esh, v4: 10.0.50.80,     note: CT110 on esh-pve — RTX 2000E Ada, embedding + reranking (TEI) + reward seat}
+  - {name: esh-matter,       site: esh, v4: 10.0.90.20,     note: CT111 on esh-pve — VLAN 90 (esh-iot) only; Matter server (matter.js) for HA; :5580 open to HA 10.0.50.46 only}
   - {name: vm-esh-nas,       site: esh, v4: 10.0.50.154,    note: NAS-adjacent docker host}
   - {name: esh-filebot,      site: esh, v4: 10.0.50.70,     note: restic / file-sync VM}
   - {name: esh-gw,           site: esh, v4: 10.0.250.1,     note: esh-gw}