feat(esh-matter): Matter server (matter.js 1.4.0) on a VLAN-90-only LXC for Home Assistant

For ha-dev (operator-approved 2026-09-26). CT 111 on esh-pve at 10.0.90.20:
Matter/Thread IPv6 (Echo ULA + RA route-information) is link-only, so the
server sits on esh-iot and HA reaches it over routed IPv4 ws :5580.
- playbooks/esh-matter-lxc.yaml: kernel RA (accept_ra=1,
  rt_info_max_plen=64), forwarding off, Docker ip-forward/iptables off;
  nftables admits 5580 from HA 10.0.50.46 only and SSH from mgmt ranges;
  the CT is added to esh-pve's vzdump job (fabric credentials).
- stacks/matter-server: ghcr.io/matter-js/matterjs-server:1.4.0 (digest),
  host networking, /data on the CT.
- Acceptance: fdad:: SLAAC, ping6 thermostat, 2 Thread RIO routes learned, ws
  server_info from inside the HA container; 5580 refused from 10.0.50.45,
  nh3-dev and a temporary VLAN 90 netns vantage.

stacks/matter-server/.env.example

@@ -0,0 +1,4 @@
+# matter-server tunables (esh-matter). Copy to `.env` on the server.
+# matter.js server 1.4.0 (stable, 2026-08-07), pinned by digest.
+MATTER_IMAGE=ghcr.io/matter-js/matterjs-server:1.4.0@sha256:54232d0d3e7dff5a54759469d2753399270412b4c30c55b31750a4595e4cb236
+MATTER_LOG_LEVEL=info

stacks/matter-server/README.md

@@ -0,0 +1,18 @@
+# matter-server
+
+The **Matter controller for Home Assistant**: matter.js server
+(`ghcr.io/matter-js/matterjs-server`, **1.4.0**, digest-pinned) on **esh-matter**
+(CT 111, VLAN 90 only, `10.0.90.20`), with host networking. HA's `matter`
+integration connects to `ws://10.0.90.20:5580/ws`.
+
+- matter.js server is the drop-in successor to python-matter-server (HA has used
+  it since 2026.2), with the same websocket API.
+- `/data` → `/opt/docker/data/matter-server` (owned by uid 1000, the image's
+  unprivileged user) holds the **fabric root credentials**. It is covered by the
+  CT's vzdump backup. Never commit it.
+- :5580 is unauthenticated, so the CT firewall admits HA (10.0.50.46) only.
+- Host requirements (IPv6 RA with route-info, forwarding off) and acceptance
+  results: [`servers/esh-matter/README.md`](../../servers/esh-matter/README.md).
+
+Deploy: `scripts/deploy-stack.sh esh-matter matter-server`, then on the host
+`cp -n .env.example .env && docker compose config -q && docker compose up -d`.

stacks/matter-server/compose.yaml

@@ -0,0 +1,30 @@
+# matter-server — the Matter controller for Home Assistant, on esh-matter (CT 111
+# on esh-pve, whose ONLY network leg is VLAN 90 / esh-iot, 10.0.90.20).
+# Requested by ha-dev, operator-approved 2026-09-26.
+#
+# matter.js server (matter-js/matterjs-server), the drop-in successor to
+# python-matter-server that HA has used since 2026.2. Same websocket API on
+# :5580/ws. Pinned: 1.4.0 (stable, 2026-08-07) by digest.
+#
+# host networking is REQUIRED: Matter is IPv6 link-local and mDNS. The server must
+# see eth0's Thread ULA and the border routers' RAs directly.
+#
+# ⚠ :5580 (websocket + dashboard) is UNAUTHENTICATED. The CT's nftables admits it
+# only from HA at 10.0.50.46 (playbooks/esh-matter-lxc.yaml).
+# ⚠ /data holds the Matter fabric ROOT CREDENTIALS. Losing it means re-commissioning
+# every device. The whole CT is in esh-pve's vzdump job (PBS-ANA → PBS-NH3). Never
+# put it in git.
+name: matter-server
+services:
+  matter-server:
+    image: ${MATTER_IMAGE}
+    container_name: matter-server
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - /opt/docker/data/matter-server:/data
+    environment:
+      - STORAGE_PATH=/data
+      - PRIMARY_INTERFACE=eth0
+      - TZ=America/Los_Angeles
+      - LOG_LEVEL=${MATTER_LOG_LEVEL:-info}