feat(albok): move albok-service to a dedicated VM, nh3-albok (VM 110 on nh3-pve-2)

albok-service leaves nh3-docker before unit 4 puts the personal vault and
licensed books into restricted wings. On nh3-docker, portainer, portainer_agent,
dockge (socket rw) and dockerd on plaintext tcp/2375 were each root over
/srv/albok. The new host runs only albok-service: no socket containers and no
TCP Docker API, so its Homepage tile is a static services.yaml entry.

- nh3-pve-2: vmbr0 made VLAN-aware (applied by reboot, no guests running);
  pbs-ana storage in the new namespace nh3-pve-2, plus a 21:30 vzdump job
  (pbs-nh3's recursive sync mirrors it)
- VM 110 nh3-albok, 10.100.50.44 on VLAN 50, Debian 13 cloud-init, 4 vCPU
  x86-64-v3 / 12 GiB / 100 GB; built to fleet conventions (vh 1000,
  infra-ops 850, docker 851)
- compose: mem_limit 4g -> 8g, homepage labels removed; host port 8392 kept
- cutover by tar stream, verified by digest (contents plus owner, group, mode,
  mtime and type identical); albok.nh3.internal now points at nh3-albok
- old /srv/albok stays on nh3-docker (container removed, compose renamed)
  until acceptance and the operator's approval to delete it
- sudo-io archive hosts and ops-log STACK_HOSTS include nh3-albok

stacks/homepage/conf/services.yaml

@@ -85,6 +85,16 @@
 # well or it renders twice. To move a service between AI groups, change the
 # label on its compose file and recreate the container — labels are read at
 # creation, so `restart` will not do it.
+- Agents (no UI):
+  # Manual entry — albok-service moved to nh3-albok (2026-10-04), a host that deliberately does NOT
+  # expose its Docker API on tcp/2375 (it holds restricted wings), so it is not in docker.yaml and its
+  # container carries no homepage labels. Do not add the host to docker.yaml to "fix" discovery.
+  - Albok:
+      href: http://10.100.50.44:8392/health
+      icon: mdi-book-search
+      siteMonitor: http://10.100.50.44:8392/health
+      description: Fleet knowledgebase service (albok-service) on nh3-albok
+
 - AI - Studios:
   # Manual entry — Voice Design Studio is a user-level systemd service on
   # irv-ml1, not a Docker-labeled stack, so it cannot auto-discover. It sits