feat(albok): move albok-service to a dedicated VM, nh3-albok (VM 110 on nh3-pve-2)

albok-service leaves nh3-docker before unit 4 puts the personal vault and
licensed books into restricted wings. On nh3-docker, portainer, portainer_agent,
dockge (socket rw) and dockerd on plaintext tcp/2375 were each root over
/srv/albok. The new host runs only albok-service: no socket containers and no
TCP Docker API, so its Homepage tile is a static services.yaml entry.

- nh3-pve-2: vmbr0 made VLAN-aware (applied by reboot, no guests running);
  pbs-ana storage in the new namespace nh3-pve-2, plus a 21:30 vzdump job
  (pbs-nh3's recursive sync mirrors it)
- VM 110 nh3-albok, 10.100.50.44 on VLAN 50, Debian 13 cloud-init, 4 vCPU
  x86-64-v3 / 12 GiB / 100 GB; built to fleet conventions (vh 1000,
  infra-ops 850, docker 851)
- compose: mem_limit 4g -> 8g, homepage labels removed; host port 8392 kept
- cutover by tar stream, verified by digest (contents plus owner, group, mode,
  mtime and type identical); albok.nh3.internal now points at nh3-albok
- old /srv/albok stays on nh3-docker (container removed, compose renamed)
  until acceptance and the operator's approval to delete it
- sudo-io archive hosts and ops-log STACK_HOSTS include nh3-albok

playbooks/nh3-albok-vm.yaml

@@ -0,0 +1,98 @@
+# Create VM 110 `nh3-albok` on nh3-pve-2: the dedicated albok-service host (2026-10-04).
+#   scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-albok-vm.yaml
+# Needs vmbr0 VLAN-aware first (playbooks/nh3-pve-2-vmbr0-vlan-aware.yaml + a reboot).
+#
+# Why a VM of its own (albok-dev, relaying Prime 2026-10-04 ~2235): on nh3-docker the store shared a
+# host with three containers holding the docker socket read-write (portainer, portainer_agent, dockge)
+# plus dockerd on plaintext tcp/2375 for Homepage. Each of those is root over /srv/albok, and unit 4
+# puts the operator's personal vault and licensed books into restricted wings. Also memory: albok sat
+# at 2.4 of a 4 GiB cap on a 7.7 GiB host it shared with the post office and AdGuard.
+#
+# Shape: Debian 13 genericcloud + cloud-init. 4 vCPU (x86-64-v3: AVX2 for the index code, and still
+# restorable on nh3-pve's i9-13900H), 12 GiB, 100 GB on `vmstore`, VLAN 50 (nh3-servers) at
+# 10.100.50.44 — below the UDM's DHCP pool (.150–.249), like every other static on that VLAN.
+# VMID 110 continues the NH3 numbering (nh3-pve holds 100–109) so "VM 110" is unambiguous on the site;
+# PBS keeps nodes apart by namespace anyway.
+#
+# cloud-init creates `vh` (uid 1000, the fleet's human account) with NOPASSWD sudo. infra-ops (uid 850)
+# is then built by playbooks/bootstrap-infra-ops-user.yaml run AS vh, after which the infra-ops key is
+# taken back off vh (playbooks/nh3-albok-host.yaml).
+vars:
+  vmid: "110"
+  name: nh3-albok
+  ip: 10.100.50.44/24
+  gw: 10.100.50.1
+  # nh3-docker AdGuard first, ana-docker AdGuard second: the same pair the UDM hands out on VLAN 50
+  dns: 10.100.50.40 10.250.50.70
+  img_url: https://cloud.debian.org/images/cloud/trixie/latest
+  img: debian-13-genericcloud-amd64.qcow2
+  img_dir: /var/lib/vz/import
+
+steps:
+  - name: refuse unless this is nh3-pve-2, vmbr0 is VLAN-aware, and the VMID and address are free
+    sudo: true
+    shell: |
+      set -e
+      test "$(hostname)" = nh3-pve-2
+      test "$(cat /sys/class/net/vmbr0/bridge/vlan_filtering)" = 1
+      if ping -c2 -W1 $(echo {{ ip }} | cut -d/ -f1) >/dev/null 2>&1; then echo "{{ ip }} ANSWERS — taken"; exit 1; fi
+    changed_when: "false"
+    when: "! qm status {{ vmid }} >/dev/null 2>&1"
+
+  - name: fetch the Debian 13 genericcloud image and check it against SHA512SUMS
+    sudo: true
+    shell: |
+      set -e
+      install -d -m 0755 {{ img_dir }}
+      cd {{ img_dir }}
+      curl -fsSL -o SHA512SUMS.trixie {{ img_url }}/SHA512SUMS
+      curl -fsSL -o {{ img }}.part {{ img_url }}/{{ img }}
+      want=$(awk '$2=="{{ img }}"{print $1}' SHA512SUMS.trixie)
+      test -n "$want"
+      echo "$want  {{ img }}.part" | sha512sum -c -
+      mv {{ img }}.part {{ img }}
+    when: "! qm status {{ vmid }} >/dev/null 2>&1"
+
+  - name: create VM {{ vmid }} ({{ name }})
+    sudo: true
+    shell: |
+      set -e
+      qm create {{ vmid }} --name {{ name }} --ostype l26 --cpu x86-64-v3 --cores 4 --memory 12288 \
+        --scsihw virtio-scsi-single --agent enabled=1 --onboot 1 --tags albok \
+        --net0 virtio,bridge=vmbr0,tag=50,firewall=1 \
+        --serial0 socket --vga serial0 \
+        --description "albok-service host (fleet knowledgebase). Runs ONLY albok-service. Built 2026-10-04, eshpfi playbooks/nh3-albok-vm.yaml + nh3-albok-host.yaml; servers/nh3-albok/README.md"
+      qm set {{ vmid }} --scsi0 vmstore:0,import-from={{ img_dir }}/{{ img }},discard=on,ssd=1,iothread=1
+      qm disk resize {{ vmid }} scsi0 100G
+      qm set {{ vmid }} --ide2 vmstore:cloudinit --boot order=scsi0
+    creates: /etc/pve/qemu-server/{{ vmid }}.conf
+
+  - name: cloud-init — user vh, keys, static address, resolvers
+    sudo: true
+    shell: |
+      set -e
+      k=$(mktemp)
+      cat > "$k" <<'EOF'
+      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+1HBwfXrkfTYWdcnWCjLJ6VLAGC87gxH5h5vKaaA3c infra-ops@pfi-fleet
+      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGm/lJslGEL2xDBY/7LdUc0Q4GyuxwFtGspYTe6WsVE lkrav@VHHomeG13
+      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDP/AwgaLghPoQi9RDt+m/9H9jLHDoP93WgzczlhZlSvZoQ5qDpWu5oAQlRwImiWhVL1ClK4FwEz9JULsta7Uq3FaiQvs2ltevrW/EpNbhAfxZa4Z1ELrPAOO8SSlhZ+Zer33SPkfJD9t3Hi9TXheCaANiEtE6hH1nCVLpHWQdbzy+L7EyG8z+/RzNXwwIL8f0BZ8n7FvFujgwc1OQTXlg4fiW3FdB3uzJMVRT59IIsPEq/ODGZZ6XGtHy24Ewcsi8l78I+oKaPdMl8ZXNBQrNb0MPIJnHkQwTrzlDKZ0Oh1UKm7I9i9hDMB/M2+aQ+6MxzY5TLZyDvRYd8R3j9Mnrp3ouCnNcklGAkX7i8hNJ2y8xCbwOeP8sMd+VtQ6hBbNa6KAEaAgGuWHHS0KGGO4HjtvDxJH8e7BnGzveIeCUGLVKMrg08w9nqF6Kzf3Y72ou0yCmnu7kKqocS1Pcr+e5E1MdT4brc2BfYkzqExLp8gxQaJ1Zas2OXPNXpAxL58xc= lkraven@nh3-dev
+      EOF
+      sed -i 's/^ *//' "$k"
+      qm set {{ vmid }} --ciuser vh --sshkeys "$k" --ipconfig0 ip={{ ip }},gw={{ gw }} \
+        --nameserver "{{ dns }}" --searchdomain nh3.internal --ciupgrade 1
+      rm -f "$k"
+    when: "! qm config {{ vmid }} | grep -q '^ciuser: vh'"
+
+  - name: start VM {{ vmid }}
+    sudo: true
+    shell: qm start {{ vmid }}
+    when: "! qm status {{ vmid }} | grep -q running"
+
+verify:
+  - name: VM is running with the intended shape
+    sudo: true
+    shell: |
+      qm status {{ vmid }}
+      qm config {{ vmid }} | grep -E '^(name|cores|cpu|memory|net0|scsi0|ipconfig0|onboot|ciuser):'
+      qm status {{ vmid }} | grep -q running
+    changed_when: "false"