feat(homepage): bring the fleet dashboard under version control

Homepage on esh-docker-vm:5100 was the one stack whose config lived only on
the host, edited in place. Its version history was six hand-rolled
services.yaml.bak-* files. Now canonical here and deployed with
deploy-stack.sh like everything else; the .bak files are gone.

Corrections from the audit:
- ANA-Firewall described a 'Fortigate 81F'. It is a FortiGate-80F running
  FortiOS 7.2.10, verified live against the device.
- NH3-Ansible pointed at 10.100.50.42 as an 'Ansible control node'. That host
  is nh3-extdev, the manager/external-dev successor after nh3-ansible was
  retired. Renamed and re-described.
- Dropped the UltraSeedbox layout group: nothing provides it, so it only ever
  rendered empty.

Adds .env.example and a README documenting the two-path service model (docker
label discovery across five engines vs manual entries), the labels-only-apply-
on-recreate rule, and the foot-guns found: HOMEPAGE_ALLOWED_HOSTS matches
host AND port so a bare IP does not cover IP:port; :2375 is plaintext and
unauthenticated on all five engines; ping: cards can only be judged from the
dashboard host.

Verified after deploy via /api/services: 105 cards across 19 groups, both
corrections live, ana-docker discovery intact.

stacks/homepage/conf/docker.yaml

@@ -0,0 +1,38 @@
+---
+# https://gethomepage.dev/latest/configs/docker/
+#
+# All four Docker hosts expose the engine on port 2375. This is plaintext
+# and works fine on a trusted LAN; if any host is ever exposed or shared,
+# switch to a TLS socket (examples commented below).
+
+esh-vm-docker:
+  host: 10.0.50.45
+  port: 2375
+
+ana-pfi-docker:
+  host: 10.250.50.70
+  port: 2375
+
+nh3-pfi-docker:
+  host: 10.100.50.40
+  port: 2375
+
+ana-ml2-docker:
+  host: 10.250.50.54
+  port: 2375
+
+# irv-ml1 — reachable ONLY via WireGuard tunnel, so docker auto-discovery
+# traffic traverses the tunnel. If WG drops, homepage will show irv-ml1
+# services as offline until reconnect.
+irv-ml1-docker:
+  host: 10.100.79.3
+  port: 2375
+
+# Example TLS socket (if/when a host moves off plaintext 2375):
+# ana-pfi-docker:
+#   host: 10.250.50.70
+#   port: 2376
+#   tls:
+#     keyFile: docker-tls/ana-docker/key.pem
+#     caFile:  docker-tls/ana-docker/ca.pem
+#     certFile: docker-tls/ana-docker/cert.pem