feat(albok): move albok-service to a dedicated VM, nh3-albok (VM 110 on nh3-pve-2)

albok-service leaves nh3-docker before unit 4 puts the personal vault and
licensed books into restricted wings. On nh3-docker, portainer, portainer_agent,
dockge (socket rw) and dockerd on plaintext tcp/2375 were each root over
/srv/albok. The new host runs only albok-service: no socket containers and no
TCP Docker API, so its Homepage tile is a static services.yaml entry.

- nh3-pve-2: vmbr0 made VLAN-aware (applied by reboot, no guests running);
  pbs-ana storage in the new namespace nh3-pve-2, plus a 21:30 vzdump job
  (pbs-nh3's recursive sync mirrors it)
- VM 110 nh3-albok, 10.100.50.44 on VLAN 50, Debian 13 cloud-init, 4 vCPU
  x86-64-v3 / 12 GiB / 100 GB; built to fleet conventions (vh 1000,
  infra-ops 850, docker 851)
- compose: mem_limit 4g -> 8g, homepage labels removed; host port 8392 kept
- cutover by tar stream, verified by digest (contents plus owner, group, mode,
  mtime and type identical); albok.nh3.internal now points at nh3-albok
- old /srv/albok stays on nh3-docker (container removed, compose renamed)
  until acceptance and the operator's approval to delete it
- sudo-io archive hosts and ops-log STACK_HOSTS include nh3-albok

dns/internal.yaml

@@ -85,6 +85,7 @@ hosts:
   - {name: nh3-pve-2,        site: nh3, v4: 10.100.250.62,  note: Proxmox host nh3-pve-2 (MS-03) on its X710 SFP+ (38:05:25:3b:a0:a8) — USW Pro 24 port 25 (native nh3-mgmt, tagged auto), DHCP reservation}
   - {name: nh3-pve-2-amt,    site: nh3, v4: 10.100.250.63,  note: Intel AMT 21 (vPro) on nh3-pve-2's (MS-03) I226-LM — UDM port 5 (native nh3-mgmt), DHCP reservation for 38:05:25:3b:a0:a6; LAN mgmt goes dark once CIRA is set up}
   - {name: pbs-nh3,          site: nh3, v4: 10.100.50.90,   note: Proxmox Backup Server — DR mirror}
+  - {name: nh3-albok,        site: nh3, v4: 10.100.50.44,   note: VM 110 on nh3-pve-2 — runs ONLY albok-service (no Docker API on tcp, no socket containers)}
   - {name: nh3-gw,           site: nh3, v4: 10.100.0.1,     note: UniFi UDM Pro SE — gateway + controller}
   # Irvine is not its own DNS site: it is a single box (irv-ml1) reached over
   # the headscale mesh, so it is named under nh3 rather than getting its own
@@ -122,7 +123,7 @@ hosts:
 # runs becomes a one-line edit here instead of a hunt through configs.
 
 aliases:
-  - {name: albok,     site: nh3, target: nh3-docker, note: albok-service (fleet knowledgebase) :8392 — container :8390; 8390 on the host is the post office}
+  - {name: albok,     site: nh3, target: nh3-albok,  note: albok-service (fleet knowledgebase) :8392 — container :8390; on nh3-albok (VM 110, nh3-pve-2) since 2026-10-04, nh3-docker before}
   - {name: searxng,   site: nh3, target: nh3-docker, note: moved off ana-docker 2026-09-03 — colo egress (38.120.12.42) is CAPTCHA-gated by search engines; NH3 egresses residentially}
   - {name: gateway,   site: ana, target: ana-docker, note: LiteLLM gateway :4000}
   - {name: booth,     site: nh3, target: nh3-dev,    note: The Booth :8090}