refactor(playbooks): host-generic GPU host + GPU LXC playbooks for nh3-ml1

- esh-pve-nvidia-host -> pve-nvidia-host: headers/dkms/build-essential step,
  nouveau blacklist + guarded unload (refuses if nouveau bound a device)
- esh-ml1-lxc -> gpu-lxc: host vars have no defaults (elway aborts on undefined),
  rootfs storage/startup order parameterized, CT kept out of all-guests vzdump jobs
- embed-rerank: Homepage labels take HOST_NAME/HOST_IP, defaults = esh-ml1

persistent-memory.d/2026-09-24-esh-ml1-embed-rerank.md

@@ -5,7 +5,7 @@ Executes Prime's 2026-09-24 decision (LXC + host driver, not a VFIO VM). Done
 
 **Host (esh-pve).** NVIDIA **580.178.04** open modules via DKMS from NVIDIA's
 `-no-compat32.run` (sha256 checked against NVIDIA's published sum), applied
-live by `playbooks/esh-pve-nvidia-host.yaml`: nouveau was never loaded and the
+live by `playbooks/pve-nvidia-host.yaml`: nouveau was never loaded and the
 T400's vfio ids matched nothing, so nothing held the card. Our own
 `nvidia-persistenced.service` creates `/dev/nvidia{0,ctl,-uvm,-uvm-tools}`
 **before `pve-guests`** (else `pct start` refuses the `devN:` entries). Retired
@@ -15,7 +15,7 @@ rebuilt on purpose (boot path untouched). 580 because the fleet's vLLM
 not an apt repo: one file on both sides makes the host-module/container-lib
 version match true by construction; apt would let an upgrade move one side.
 
-**CT 110 `esh-ml1`** (`playbooks/esh-ml1-lxc.yaml`): unprivileged Debian 12,
+**CT 110 `esh-ml1`** (`playbooks/gpu-lxc.yaml`): unprivileged Debian 12,
 nesting+keyctl, 6c/16G/80G `local-lvm`, `10.0.50.80` VLAN 50 (static; UDM pool
 is `.150–.250`), `startup order=30` after esh-scale/VMs. NVIDIA userspace from
 the same `.run` with `--no-kernel-modules`; docker-ce; nvidia-container-toolkit