feat(nh3-pve): move AMT to nh3-mgmt (UDM port 6 native VLAN 250) + Homepage link

- PFI-UDMSE port 6 override: native nh3-mgmt, tagged VLANs blocked (was
  forward all / native default). Reservation nh3-pve-amt -> 10.100.250.61.
- nh3-pve: arp_ignore=8 / arp_announce=2 on enp88s0 (now on vmbr0's untagged
  L2) so the host never answers ARP for 10.100.250.60 with the AMT port's MAC.
- DNS nh3-pve-amt.nh3.internal -> 10.100.250.61.
- Homepage: NH3-PVE-AMT card under Infra - NH3 (no siteMonitor/ping: AMT drops
  ICMP and its legacy-renegotiation TLS fails Homepage's fetch).
- AMT keeps its old 10.100.0.151 lease until rebind/expiry (~1920-2224 PT
  2026-09-26); it does not re-DHCP on a VLAN change or link drop (measured).

stacks/homepage/conf/services.yaml

@@ -192,6 +192,14 @@
       siteMonitor: https://10.100.250.60:8006/
       icon: si-proxmox
       description: Proxmox hypervisor (nh3-pve)
+  # Intel AMT on nh3-pve's I226-LM (UDM port 6, nh3-mgmt, DHCP reservation).
+  # No siteMonitor/ping on purpose: AMT drops ICMP, and its TLS needs legacy
+  # renegotiation, which Homepage's fetch refuses, so a monitor reads DOWN forever.
+  # Remote screen needs MeshCommander, not this page (servers/nh3-pve/README.md).
+  - NH3-PVE-AMT:
+      href: https://10.100.250.61:16993/
+      icon: si-intel
+      description: Intel AMT (vPro) — OOB for nh3-pve; login admin / MEBx password
   - NH3-VM-Docker:
       href: http://10.100.50.40:5001
       icon: si-docker