Snapshot both servers: the VPS catalog moves to server/vps, the home server joins as server/home

The catalog in server/containers had drifted from the VPS. Eleven compose
files and twelve units no longer matched what runs, and two running
services, Gbrown_Agent and BillTracker, were missing. server/vps is now a
copy of the live files, and panama-server reads from it.

server/home holds the home server's services in the same shape. They still
run under Docker, so the podman units there are drafts for a later move, and
nothing installs from that tree. PostHog, Sentry and Plausible are checkouts
of upstream repositories. Only their local files are kept, next to an
UPSTREAM file naming the repository and the exact commit.

Every secret in both trees is a ${VAR} reference named in .env.example, or
CHANGE_ME in files that are not compose files. The live servers still hold
some of those values inline, so a live file can differ from its copy on
those lines alone. Existing .env.example files keep their comments, with new
keys appended at the end.

The ignore rules and the secrets contract now cover both trees, plus the
volume/ and volumes/ directories the home server uses.

server/vps/Beszel/compose.yml

@@ -0,0 +1,75 @@
+# Beszel — lightweight host + container monitoring, VPS (ROOTLESS PODMAN) edition.
+#
+# Adapted from the home server's Docker/root version. Differences and why:
+#
+#   docker.sock -> /run/user/1000/podman/podman.sock
+#       Rootless podman's API socket. It exposes ONLY rootless containers, which is
+#       exactly the set we want reported. No :Z on the socket mount -- relabeling the
+#       live socket breaks podman. See AGENTS.md §6.
+#
+#   security_opt: label:disable on the agent
+#       Required under SELinux Enforcing to read that socket, which systemd recreates
+#       each boot as user_tmp_t. Same treatment as portainer/uptime.
+#
+#   EXTRA_FILESYSTEMS=/boot dropped
+#       The home server has /boot on its own 974M partition. This VPS does not --
+#       /dev/sda1 is the whole root fs and /boot/efi is a 64M ESP not worth alerting on.
+#
+#   No hostname/domainname on the agent
+#       Host networking forbids them, same as on the home server.
+#
+# The hub generates its keypair on first start at ./volumes/hub/id_ed25519.pub.
+# That public key is what goes in the agent's KEY below.
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  beszel:
+    image: docker.io/henrygd/beszel:latest
+    container_name: beszel
+    hostname: beszel
+    domainname: beszel.gibbyb.com
+    networks: ['nginx-bridge']
+    # No published port: NPM proxies to http://beszel:8090 over nginx-bridge.
+    environment:
+      - TZ=America/New_York
+      # Login is SSO-only through Authentik (OIDC provider "Gibs Auth", app slug
+      # beszel). The OAuth config lives in data.db (users collection options),
+      # not here. The PocketBase superuser panel at /_/ keeps its own password,
+      # and is the way back in if Authentik is down: flip this to false there.
+      - DISABLE_PASSWORD_AUTH=true
+    # Lets the hub reach a host-network agent. Under rootless podman this resolves to
+    # the nginx-bridge gateway (172.18.0.1). Add the VPS in the hub UI with host
+    # "host.docker.internal", port 45876.
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./volumes/hub:/beszel_data:Z
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
+
+  beszel-agent:
+    image: docker.io/henrygd/beszel-agent:latest
+    container_name: beszel-agent
+    network_mode: host
+    environment:
+      - TZ=America/New_York
+      - PORT=45876
+      # This hub's public key. Newer Beszel writes only ./volumes/hub/id_ed25519 (private);
+      # derive the public half with:  ssh-keygen -y -f volumes/hub/id_ed25519
+      # It is a PUBLIC key -- safe to keep in this file.
+      - KEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDBWNqxKGRltqXJZg+wlDOtICeLo19ftQ6P3P8+uJg8y
+    security_opt: ['label:disable']
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./volumes/agent:/var/lib/beszel-agent:Z
+      - /run/user/1000/podman/podman.sock:/var/run/docker.sock:ro
+    tty: true
+    stdin_open: true
+    restart: unless-stopped