feat(nh3-pve): move AMT to nh3-mgmt (UDM port 6 native VLAN 250) + Homepage link

- PFI-UDMSE port 6 override: native nh3-mgmt, tagged VLANs blocked (was
  forward all / native default). Reservation nh3-pve-amt -> 10.100.250.61.
- nh3-pve: arp_ignore=8 / arp_announce=2 on enp88s0 (now on vmbr0's untagged
  L2) so the host never answers ARP for 10.100.250.60 with the AMT port's MAC.
- DNS nh3-pve-amt.nh3.internal -> 10.100.250.61.
- Homepage: NH3-PVE-AMT card under Infra - NH3 (no siteMonitor/ping: AMT drops
  ICMP and its legacy-renegotiation TLS fails Homepage's fetch).
- AMT keeps its old 10.100.0.151 lease until rebind/expiry (~1920-2224 PT
  2026-09-26); it does not re-DHCP on a VLAN change or link drop (measured).

persistent-memory.md

@@ -132,14 +132,18 @@ hermes-gateway, Booth, ttyd, zellij-web and dev-backup are running.
   `servers/nh3-ml1/README.md` exists.
 - ⏳ **Prime's call: gateway routing.** Recommendation: load-share
   `qwen3-embedding` + `reranker` across esh-ml1 and nh3-ml1.
-- ✅ **AMT LIVE 2224: `https://10.100.0.151:16993`** (`nh3-pve-amt.nh3.internal`,
-  UDM reservation). It had no IP because Linux had the port DOWN. `igc` powers
-  off the PHY and AMT loses its link. Our own 09-25 removal of `enp88s0` from
-  vmbr0 caused that. Fix: `auto enp88s0` (up, no IP, unbridged) plus IPv6 off via
-  sysctl.d, persistent. The cable is on **UDM port 6** (`forward: all`;
-  AMT is untagged, so nh3-default).
-  **Open:** check that KVM + Opt-in None are set (needs the AMT admin password),
-  then move the NanoKVM to the gx10.
+- **AMT → nh3-mgmt at 2237 (Prime): `https://10.100.250.61:16993`**
+  (`nh3-pve-amt.nh3.internal`, Homepage *NH3-PVE-AMT*). UDM port 6 is native
+  mgmt with tags blocked, and the reservation is `.61`.
+  - ⏳ AMT is still sitting on its old `10.100.0.151` lease and is unreachable
+    until that lease rebinds or expires: ~1920 to ~2224 on 09-26. AMT does not
+    re-DHCP when its VLAN changes or its link drops.
+  - A background poll watches `.61`.
+  - Faster route: the AMT admin password (WS-Man).
+  - Earlier root cause: Linux had the port down (the `igc` PHY was off). Fixed
+    with `auto enp88s0` plus IPv6 off and `arp_ignore=8` via sysctl.d.
+  - **Open:** check KVM + Opt-in None; a dummy HDMI plug before the NanoKVM
+    moves.
 - Found and fixed: **lxc-pve 6.0.0-1 broke Docker in the CT** (runc 1.5 sysctl
   reopen denied). Upgraded that one package to 6.0.0-2 (Proxmox fix #7006), and
   `gpu-lxc.yaml` now does this itself.