feat(homepage): bring the fleet dashboard under version control

Homepage on esh-docker-vm:5100 was the one stack whose config lived only on
the host, edited in place. Its version history was six hand-rolled
services.yaml.bak-* files. Now canonical here and deployed with
deploy-stack.sh like everything else; the .bak files are gone.

Corrections from the audit:
- ANA-Firewall described a 'Fortigate 81F'. It is a FortiGate-80F running
  FortiOS 7.2.10, verified live against the device.
- NH3-Ansible pointed at 10.100.50.42 as an 'Ansible control node'. That host
  is nh3-extdev, the manager/external-dev successor after nh3-ansible was
  retired. Renamed and re-described.
- Dropped the UltraSeedbox layout group: nothing provides it, so it only ever
  rendered empty.

Adds .env.example and a README documenting the two-path service model (docker
label discovery across five engines vs manual entries), the labels-only-apply-
on-recreate rule, and the foot-guns found: HOMEPAGE_ALLOWED_HOSTS matches
host AND port so a bare IP does not cover IP:port; :2375 is plaintext and
unauthenticated on all five engines; ping: cards can only be judged from the
dashboard host.

Verified after deploy via /api/services: 105 cards across 19 groups, both
corrections live, ana-docker discovery intact.

stacks/homepage/conf/bookmarks.yaml

@@ -0,0 +1,43 @@
+# https://gethomepage.dev/latest/configs/bookmarks
+
+- UltraSeedbox:
+  - Control Panel:
+    - abbr: CP
+      icon: si-bittorrent
+      href: http://cp.ultra.cc/
+      description: Ultraseedbox Control Panel
+  - FileZilla:
+    - abbr: fz
+      icon: si-filezilla
+      href: http://10.0.50.154:5800
+      description: FTP Client
+  - ruTorrent:
+    - abbr: rt
+      icon: si-bittorrent
+      href: https://lkraven.hebe.usbx.me/rutorrent/
+      description: ruTorrent Client
+  - Sonarr:
+    - abbr: sr
+      icon: si-sonarr
+      href: https://lkraven.hebe.usbx.me/sonarr/
+      description: TV Shows
+  - Radarr:
+    - abbr: rr
+      icon: si-radarr
+      href: https://lkraven.hebe.usbx.me/radarr/
+      description: Movies
+  - Bazarr:
+    - abbr: br
+      icon: mdi-subtitles
+      href: https://lkraven.hebe.usbx.me/bazarr/
+      description: Subtitles
+  - Sabnzbd:
+    - abbr: nz
+      icon: mdi-newspaper
+      href: https://lkraven.hebe.usbx.me/sabnzbd
+      description: Newz Client
+  - Seedsync:
+    - abbr: sy
+      icon: mdi-download-box
+      href: http://10.0.50.51:8800/dashboard
+      description: Sync Client