feat(albok): move albok-service to a dedicated VM, nh3-albok (VM 110 on nh3-pve-2)

albok-service leaves nh3-docker before unit 4 puts the personal vault and
licensed books into restricted wings. On nh3-docker, portainer, portainer_agent,
dockge (socket rw) and dockerd on plaintext tcp/2375 were each root over
/srv/albok. The new host runs only albok-service: no socket containers and no
TCP Docker API, so its Homepage tile is a static services.yaml entry.

- nh3-pve-2: vmbr0 made VLAN-aware (applied by reboot, no guests running);
  pbs-ana storage in the new namespace nh3-pve-2, plus a 21:30 vzdump job
  (pbs-nh3's recursive sync mirrors it)
- VM 110 nh3-albok, 10.100.50.44 on VLAN 50, Debian 13 cloud-init, 4 vCPU
  x86-64-v3 / 12 GiB / 100 GB; built to fleet conventions (vh 1000,
  infra-ops 850, docker 851)
- compose: mem_limit 4g -> 8g, homepage labels removed; host port 8392 kept
- cutover by tar stream, verified by digest (contents plus owner, group, mode,
  mtime and type identical); albok.nh3.internal now points at nh3-albok
- old /srv/albok stays on nh3-docker (container removed, compose renamed)
  until acceptance and the operator's approval to delete it
- sudo-io archive hosts and ops-log STACK_HOSTS include nh3-albok

persistent-memory.d/2026-10-04-albok-service-moved-to-nh3-albok.md

@@ -0,0 +1,35 @@
+# albok-service moved to its own VM: nh3-albok (VM 110 on nh3-pve-2)
+
+`[2026-10-04]` **albok-service moved off nh3-docker onto nh3-albok, a VM that runs nothing else** (albok-dev relaying
+Prime ~2235; built and cut over by infra-ops 2311–2332). → `servers/nh3-albok/README.md`, `stacks/albok-service/README.md`
+
+**Why.** Unit 4 will ingest the operator's personal vault (~7,600 notes) and licensed books into restricted wings. On
+nh3-docker, four things were root over `/srv/albok`: portainer, portainer_agent and dockge (socket rw), and dockerd on
+plaintext **tcp/2375** for Homepage. albok-dev's list named the three containers; the 2375 exposure was found during
+this work and is the bigger one, since any LAN host can reach it. Memory too: 2.4 of a 4 GiB cap on a 7.7 GiB host shared with the post office
+and AdGuard.
+
+**What was built.**
+- nh3-pve-2 `vmbr0` made VLAN-aware (`playbooks/nh3-pve-2-vmbr0-vlan-aware.yaml`), applied by a **reboot at 2311 with no
+  guests**, never a live ifreload (the 10-03 lesson). AMT port came back up at 1 Gb.
+- VM 110 `nh3-albok`, 10.100.50.44 on VLAN 50, Debian 13 genericcloud + cloud-init, 4 vCPU x86-64-v3 / 12 GiB / 100 GB
+  vmstore (`playbooks/nh3-albok-vm.yaml`). `vh` 1000 via cloud-init → infra-ops 850 bootstrapped as vh → the bootstrap
+  key taken back off vh (`playbooks/nh3-albok-host.yaml`). Docker 29.8 with `docker` pinned at 851 before install.
+- **Deliberately single-tenant:** no socket containers, no `-H tcp://`, so Homepage cannot discover it. The Albok tile is a static
+  `services.yaml` entry; it hot-reloaded without a container recreate. `mem_limit` 4g → 8g.
+- PBS: nh3-pve-2 got storage `pbs-ana` (namespace **`nh3-pve-2`**, created on pbs-ana) and a 21:30 `all 1` vzdump job.
+  pbs-nh3's sync is root-namespace recursive, so the DR mirror needed nothing. The `root@pam!fleet-vzdump` secret is
+  now vaulted as `pbs-ana/fleet-vzdump-token`. albok-dev asked for "a PBS job on pbs-nh3"; the pbs-ana job keeps the fleet
+  pattern and keeps an off-site copy, and they were told why.
+
+**Cutover (2330–2332, ~2.5 min down).** Container removed on nh3-docker and its `compose.yaml` renamed
+`compose.yaml.moved-to-nh3-albok-2026-10-04` (a stray `up` there would be a second writer on a stale copy, i.e. split
+brain). One `tar --format=posix --numeric-owner` stream under `sudo /usr/bin/tar` (BULK_DATA, so nothing is recorded).
+Verified by digests only, so no restricted path was printed: 166,305 entries each side, contents identical, and owner/group/
+mode/mtime/type identical. ⚠ **A full-manifest digest that includes `%s` will MISMATCH on directories**: ext4 directory
+st_size reflects blocks once allocated, so it is not data. Split the manifest by field before deciding a copy is bad.
+New host healthy at 2331:25: 4 wings ready, drift 0, needs_reindex 0, so no reindex was needed. Then DNS moved.
+
+**Still open (as of 2332):** albok-dev's acceptance (albok-check + one Nemi walk); the first manual PBS backup of VM
+110 after acceptance; **deleting the old `/srv/albok` on nh3-docker needs Prime's word directly** (it cannot be undone,
+and the request came as a relay). Until then it sits under the same 2375 exposure as before, with nothing reading it.