feat(homepage): wire ana-ml2 back into discovery via socat proxy on ana-docker

ana-ml2 is up but not reachable cross-site from ESH (return-route gap on ana-ml2,
no SSH access to fix it). New stacks/ana-ml2-proxy: a pinned alpine/socat relay on
ana-docker (host net) exposing 10.250.50.70:2354 -> ana-ml2 10.250.50.54:2375.
Homepage docker.yaml ana-ml2-docker re-enabled pointed at the proxy. Verified:
esh-docker-vm reaches ana-ml2's docker (29.3.1) through it; /api/services returns
in 0s with 111 services; ana-ml2's inference seats (gen, coder, embed, rerank,
reward, image-bench, dockge) render. Reversible: point back at 10.250.50.54:2375
and compose-down the proxy once ana-ml2 routes to ESH.

stacks/ana-ml2-proxy/README.md

@@ -0,0 +1,30 @@
+# ana-ml2-proxy
+
+A one-container `socat` TCP relay on **ana-docker** that exposes **ana-ml2**'s
+Docker API (`10.250.50.54:2375`) as `10.250.50.70:2354`, so the Homepage
+dashboard on esh-docker-vm can discover ana-ml2's containers.
+
+## Why it exists
+
+ana-ml2 is up and its docker API is reachable from within Anaheim, but **not
+cross-site from ESH** — there's a return-route gap on ana-ml2 and no SSH path to
+it from the ops seats to fix its routing. ana-docker is on the same Anaheim
+subnet (reaches `10.250.50.54:2375` directly) and **is** reachable from ESH, so
+it relays. This avoids a mesh-route change (the kind that has black-holed sites)
+and needs no access to ana-ml2 itself.
+
+Plaintext, trusted mesh-internal only — the same posture as the fleet's other
+plaintext `:2375` docker hosts in `stacks/homepage/conf/docker.yaml`.
+
+## Deploy
+
+    scripts/deploy-stack.sh ana-docker ana-ml2-proxy --compose
+    ssh infra-ops@10.250.50.70 'cd /opt/docker/compose/ana-ml2-proxy && sudo docker compose up -d'
+
+Homepage's `docker.yaml` `ana-ml2-docker` entry points at `10.250.50.70:2354`
+(the proxy), not `10.250.50.54:2375` directly.
+
+## Undo
+
+Once ana-ml2 has a working return route to ESH, point Homepage's `ana-ml2-docker`
+back at `10.250.50.54:2375` and `docker compose down` this stack.

stacks/ana-ml2-proxy/compose.yaml

@@ -0,0 +1,24 @@
+---
+# TCP proxy on ana-docker: exposes ana-ml2's Docker API (10.250.50.54:2375) as
+# 10.250.50.70:2354 so Homepage on esh-docker-vm can discover ana-ml2's
+# containers.
+#
+# WHY: ana-ml2 is up and its docker API is reachable from within Anaheim, but
+# NOT cross-site from ESH (a return-route gap on ana-ml2 itself; there is no SSH
+# path to ana-ml2 from the ops seats to fix its routing). ana-docker sits on the
+# same Anaheim subnet, reaches ana-ml2:2375 directly, and IS reachable from ESH,
+# so it relays. Plaintext, trusted mesh-internal only — same posture as the
+# fleet's other plaintext :2375 docker hosts (docker.yaml).
+#
+# UNDO: once ana-ml2 has a working return route to ESH, point Homepage's
+# ana-ml2-docker entry back at 10.250.50.54:2375 directly and `docker compose
+# down` this stack.
+services:
+  ana-ml2-docker-proxy:
+    image: alpine/socat@sha256:ef6c281978dcd6927d9b3829484e4c4fdfc5d98de5acbd6312c04565d2d58cbf
+    container_name: ana-ml2-docker-proxy
+    restart: unless-stopped
+    # host networking so socat binds ana-docker's :2354 and reaches ana-ml2 over
+    # the host's Anaheim-subnet route; no bridge/port-map hop needed.
+    network_mode: host
+    command: TCP-LISTEN:2354,fork,reuseaddr TCP:10.250.50.54:2375

stacks/homepage/conf/docker.yaml

@@ -17,14 +17,15 @@ nh3-pfi-docker:
   host: 10.100.50.40
   port: 2375
 
-# ana-ml2-docker DISABLED 2026-09-07: 10.250.50.54:2375 is not reachable from
-# esh-docker-vm (docker API not exposed/listening — ana-docker 10.250.50.70:2375
-# on the SAME subnet IS reachable, so this is host-specific, not routing). A dead
-# host here hangs the entire /api/services aggregation until its TCP connect times
-# out. Re-enable once ana-ml2 exposes the docker API and it is reachable from ESH.
-# ana-ml2-docker:
-#   host: 10.250.50.54
-#   port: 2375
+# ana-ml2-docker — reached via a socat proxy on ana-docker (stacks/ana-ml2-proxy).
+# ana-ml2's own :2375 is up but not reachable cross-site from ESH (a return-route
+# gap on ana-ml2 itself; no SSH access from the ops seats to fix its routing).
+# ana-docker is on the same Anaheim subnet and IS reachable from ESH, so it
+# relays 10.250.50.70:2354 -> 10.250.50.54:2375. Point back at 10.250.50.54:2375
+# and `docker compose down` the proxy once ana-ml2 has a return route to ESH.
+ana-ml2-docker:
+  host: 10.250.50.70
+  port: 2354
 
 # irv-ml1 — moved 10.100.79.3 -> 10.6.110.50 on 2026-09-06 (headscale cutover;
 # the old wg0 tunnel IP is dormant and no longer answers). Reachable from