feat(beszel): commit the fleet agent rollout — configs, playbooks and runbooks

Beszel agents are installed and verified across the fleet but the artifacts that
produced them were never committed, so the deployment existed only on the hosts.

Adds the per-host agent environment files (PORT, NICS, EXTRA_FILESYSTEMS and the
hub's PUBLIC key), the systemd unit, the guest install script, the Synology
compose, and the elway playbooks for native, guest-stage, guest-install and
Synology paths. The two dated memory detail files covering the priority-1 and
priority-2 waves ship alongside, per the convention that memory lands with the
work it describes.

No credentials here. The KEY= value in every host env is the Beszel hub's public
ed25519 key, identical across all nine and public by design; the agent README
says so explicitly. The nh3-nas sudo password referenced in the runbook prose
lives in Vaultwarden and the helper scripts named there never contained it.

⚠ Overlapping VMIDs across hypervisors are a standing trap and are recorded in
the priority-2 notes: pfi-pve 105=postgres and 100=pbs-ana, nh3-pve 105=pbs-nh3.
⚠ PBS-NH3's export was ~75.5% used at capture; resource checks are not job
success monitoring and should not be read as such.

stacks/beszel/README.md

@@ -1,8 +1,19 @@
 # Beszel fleet monitoring
 
+Priority 2 completed 2026-09-11: pfi-postgres, esh-vm-db, pbs-ana and pbs-nh3
+added with 16 alerts. Live samples verified, including both PBS datastores.
+Fleet 17/18 up (known ana-ml2 outage). See `configs/beszel-agent/PRIORITY2.md`.
+
 Hub: http://10.250.50.70:8090 (ana-docker), version 0.18.7 at the
 2026-09-10 wiring. The hub also retains corviduo-dev's existing registration.
 
+2026-09-11: five native agents added (ana-nas plus pfi-pve, nh3-pve,
+esh-pve and esh-pve-nas); 13 systems total and 20 additional alert rules.
+See `configs/beszel-agent/README.md`. Subsequently nh3-nas was installed via
+DSM Docker and registered with four alerts (14 registrations total). Recovery
+verification at 2026-09-12 01:51Z: all six priority-1 hosts up, Synology live
+filesystem samples verified; fleet 13/14 up with known ana-ml2 outage.
+
 | Host | Compose directory under `/opt/docker/compose/` | Additional filesystems |
 |---|---|---|
 | ana-docker | beszel | /mnt/backup |

stacks/beszel/synology/compose.yaml

@@ -0,0 +1,16 @@
+services:
+  beszel-agent:
+    image: henrygd/beszel-agent:0.18.7
+    container_name: beszel-agent
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - ./agent-data:/var/lib/beszel-agent
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /usr/share/zoneinfo:/extra-filesystems/system:ro
+      - ./:/extra-filesystems/volume1:ro
+    environment:
+      PORT: '45876'
+      KEY: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHdG5fWcEZHK45sRlx8kyvrd9agexKQv4QK9Dc07wTLt'
+      FILESYSTEM: /extra-filesystems/system
+      EXTRA_FILESYSTEMS: /extra-filesystems/volume1