feat(albok): move albok-service to a dedicated VM, nh3-albok (VM 110 on nh3-pve-2)

albok-service leaves nh3-docker before unit 4 puts the personal vault and
licensed books into restricted wings. On nh3-docker, portainer, portainer_agent,
dockge (socket rw) and dockerd on plaintext tcp/2375 were each root over
/srv/albok. The new host runs only albok-service: no socket containers and no
TCP Docker API, so its Homepage tile is a static services.yaml entry.

- nh3-pve-2: vmbr0 made VLAN-aware (applied by reboot, no guests running);
  pbs-ana storage in the new namespace nh3-pve-2, plus a 21:30 vzdump job
  (pbs-nh3's recursive sync mirrors it)
- VM 110 nh3-albok, 10.100.50.44 on VLAN 50, Debian 13 cloud-init, 4 vCPU
  x86-64-v3 / 12 GiB / 100 GB; built to fleet conventions (vh 1000,
  infra-ops 850, docker 851)
- compose: mem_limit 4g -> 8g, homepage labels removed; host port 8392 kept
- cutover by tar stream, verified by digest (contents plus owner, group, mode,
  mtime and type identical); albok.nh3.internal now points at nh3-albok
- old /srv/albok stays on nh3-docker (container removed, compose renamed)
  until acceptance and the operator's approval to delete it
- sudo-io archive hosts and ops-log STACK_HOSTS include nh3-albok

playbooks/nh3-albok-host.yaml

@@ -0,0 +1,95 @@
+# Base build for nh3-albok (VM 110 on nh3-pve-2, 10.100.50.44): the dedicated albok-service host.
+#   scripts/elway infra-ops@10.100.50.44 --playbook playbooks/nh3-albok-host.yaml
+# Order: playbooks/nh3-albok-vm.yaml (on nh3-pve-2) → bootstrap-infra-ops-user.yaml run AS vh → this
+# → albok-service-host.yaml (ids + /srv/albok) → stacks/albok-service/README.md deploy steps.
+#
+# Built to docs/pfi/fleet-conventions.md: `vh` 1000 (cloud-init), `infra-ops` 850, `docker` gid 851
+# created BEFORE docker-ce so the package adopts it, /opt/docker root:docker 2775.
+#
+# ⚠ This host exists to keep root-over-docker away from the albok store. So, unlike the general docker
+#   hosts, it gets NO portainer/dockge/agent containers, NO socket mounts, and dockerd does NOT listen on
+#   tcp/2375 (Homepage cannot discover it; the Homepage entry for albok is static in services.yaml).
+#   Do not add any of those here. A host-level read of containers is `ssh` + `docker ps`.
+steps:
+  - name: take the bootstrap infra-ops key back off vh (vh keeps the operator's keys)
+    sudo: true
+    shell: |
+      set -e
+      f=/home/vh/.ssh/authorized_keys
+      grep -v 'infra-ops@pfi-fleet' "$f" > "$f.new"
+      test -s "$f.new"
+      chown vh:vh "$f.new"; chmod 600 "$f.new"; mv "$f.new" "$f"
+    when: "sudo -n grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys"
+
+  - name: timezone America/Los_Angeles (the fleet's; trixie ships US/Pacific only in tzdata-legacy)
+    sudo: true
+    shell: timedatectl set-timezone America/Los_Angeles
+    when: "[ \"$(timedatectl show -p Timezone --value)\" != America/Los_Angeles ]"
+
+  - name: base packages (guest agent for vzdump freeze/thaw, rsync for the store move)
+    sudo: true
+    shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q qemu-guest-agent rsync jq curl ca-certificates gnupg
+    when: "! dpkg -s qemu-guest-agent rsync jq >/dev/null 2>&1"
+
+  - name: qemu-guest-agent running
+    sudo: true
+    shell: systemctl start qemu-guest-agent
+    when: "! systemctl is-active --quiet qemu-guest-agent"
+
+  - name: docker group pinned at gid 851 BEFORE docker-ce installs
+    sudo: true
+    shell: groupadd -g 851 docker
+    when: "! getent group docker >/dev/null"
+
+  - name: Docker's apt repo (trixie)
+    sudo: true
+    shell: |
+      set -e
+      install -d -m 0755 /etc/apt/keyrings
+      curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg
+      chmod a+r /etc/apt/keyrings/docker.gpg
+      echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release; echo $VERSION_CODENAME) stable" \
+        > /etc/apt/sources.list.d/docker.list
+      apt-get update -qq
+    creates: /etc/apt/sources.list.d/docker.list
+
+  - name: docker-ce + compose plugin
+    sudo: true
+    shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+    when: "! dpkg -s docker-ce docker-compose-plugin >/dev/null 2>&1"
+
+  - name: vh and infra-ops in docker
+    sudo: true
+    shell: usermod -aG docker vh && usermod -aG docker infra-ops
+    when: "! id -nG infra-ops | grep -qw docker || ! id -nG vh | grep -qw docker"
+
+  - name: deploy tree /opt/docker{,/compose,/conf} root:docker 2775
+    sudo: true
+    shell: |
+      install -d -o root -g docker -m 2775 /opt/docker /opt/docker/compose /opt/docker/conf
+    changed_when: "false"
+
+  - name: traefik-net exists (the fleet compose convention names it; no traefik runs here)
+    sudo: true
+    shell: docker network create traefik-net
+    when: "! sudo -n docker network inspect traefik-net >/dev/null 2>&1"
+
+verify:
+  - name: identities and groups match the fleet pin
+    shell: |
+      test "$(id -u vh)" = 1000 && test "$(id -u infra-ops)" = 850 && test "$(getent group docker | cut -d: -f3)" = 851
+      id -nG infra-ops | grep -qw docker
+    changed_when: "false"
+  - name: vh no longer carries the infra-ops key
+    sudo: true
+    shell: "! grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys && grep -c . /home/vh/.ssh/authorized_keys"
+    changed_when: "false"
+  - name: dockerd up, listening on its unix socket only (nothing on tcp/2375 or 2376)
+    sudo: true
+    shell: |
+      docker version --format '{{.Server.Version}}'
+      ! ss -ltn | grep -E ':(2375|2376)\b'
+    changed_when: "false"
+  - name: guest agent active
+    shell: systemctl is-active qemu-guest-agent
+    changed_when: "false"