Snapshot both servers: the VPS catalog moves to server/vps, the home server joins as server/home

The catalog in server/containers had drifted from the VPS. Eleven compose
files and twelve units no longer matched what runs, and two running
services, Gbrown_Agent and BillTracker, were missing. server/vps is now a
copy of the live files, and panama-server reads from it.

server/home holds the home server's services in the same shape. They still
run under Docker, so the podman units there are drafts for a later move, and
nothing installs from that tree. PostHog, Sentry and Plausible are checkouts
of upstream repositories. Only their local files are kept, next to an
UPSTREAM file naming the repository and the exact commit.

Every secret in both trees is a ${VAR} reference named in .env.example, or
CHANGE_ME in files that are not compose files. The live servers still hold
some of those values inline, so a live file can differ from its copy on
those lines alone. Existing .env.example files keep their comments, with new
keys appended at the end.

The ignore rules and the secrets contract now cover both trees, plus the
volume/ and volumes/ directories the home server uses.

server/vps/Rustdesk/compose.yml

@@ -0,0 +1,89 @@
+# RustDesk Server — VPS (ROOTLESS PODMAN) port of the home server's ~/Server/rustdesk,
+# migrated 2026-08-12.
+#
+# ⚠️ THIS SERVICE CANNOT GO BEHIND CLOUDFLARE'S PROXY.
+# RustDesk's ID/relay protocol is raw TCP/UDP on 21115-21119. Cloudflare's proxy only
+# carries HTTP/HTTPS; raw TCP needs Spectrum, which is not on this plan. So
+# rustdesk.gbrown.org MUST be a grey-cloud (DNS-only) record pointing at
+# 178.156.197.55, and these ports must be open in firewalld's public zone.
+#
+# Consequence, accepted deliberately: this publishes the VPS's real IP. That is
+# tolerable because the firewall still restricts 80/443 to Cloudflare ranges, so
+# knowing the IP does not grant access to any of the web services.
+#
+# The server keypair in ./volumes/server/id_ed25519 was carried over from the home
+# server. Its public half matches RUSTDESK_API_RUSTDESK_KEY below
+# (WLgvHhau6aa5nDPQutTHeQBpIrOEb8aPXByVBWQwkKc=), which is what lets existing clients
+# reconnect without being re-paired. NEVER regenerate it.
+#
+# Rootless adaptations:
+#   - :Z on both bind mounts (SELinux Enforcing); each is exclusive to this container.
+#   - All published ports are >1024 so no privileged-port handling is needed.
+#   - The image starts as root under s6 and drops privileges internally, so no
+#     userns_mode is required.
+#
+# PORT REFERENCE (all must be open in the firewall):
+#   21114/tcp  web UI + API        21117/tcp  hbbr relay
+#   21115/tcp  hbbs NAT type test  21118/tcp  websocket (web client)
+#   21116/tcp  hbbs ID registration 21119/tcp websocket relay
+#   21116/udp  hbbs heartbeat  <-- UDP, easy to forget
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  rustdesk-server:
+    image: docker.io/lejianwen/rustdesk-server-s6:latest
+    container_name: rustdesk-server
+    hostname: rustdesk-server
+    domainname: rustdesk.gbrown.org
+    networks: ['nginx-bridge']
+    ports:
+      - 21114:21114
+      - 21115:21115
+      - 21116:21116
+      - 21116:21116/udp
+      - 21117:21117
+      - 21118:21118
+      - 21119:21119
+    environment:
+      - MUST_LOGIN=Y
+      - TZ=America/New_York
+      # SPLIT HOSTNAMES — this is deliberate, do not "simplify" it back to one name.
+      #   relay.gbrown.org    DNS-only (grey cloud) -> 178.156.197.55
+      #                       Carries the raw TCP/UDP protocol on 21115-21119.
+      #                       Cloudflare's proxy only handles HTTP/HTTPS, so this
+      #                       hostname MUST bypass it. That publishes the VPS IP,
+      #                       which is acceptable: the firewall still restricts
+      #                       80/443 to Cloudflare ranges, so knowing the IP grants
+      #                       no access to any web service.
+      #   rustdesk.gbrown.org Proxied -> NPM -> rustdesk-server:21114
+      #                       The web console and API, over TLS via Cloudflare.
+      # Keeping the API on the proxied name is what avoids sending login
+      # credentials over plain HTTP.
+      # RELAY is read by the s6 run script as `hbbs -r $RELAY`. It is what hbbs
+      # hands back to clients when P2P hole-punching fails, so it MUST be set here:
+      # the RUSTDESK_API_* vars below only configure the web console/API, not hbbs.
+      # Left unset, the image defaults to `relay.example.com`, which resolves to
+      # nothing -- so every connection needing a relay (i.e. every off-LAN,
+      # off-WireGuard client behind CGNAT) silently fails.
+      - RELAY=relay.gbrown.org
+      - RUSTDESK_API_RUSTDESK_ID_SERVER=relay.gbrown.org
+      - RUSTDESK_API_RUSTDESK_RELAY_SERVER=relay.gbrown.org
+      - RUSTDESK_API_RUSTDESK_API_SERVER=https://rustdesk.gbrown.org
+      - RUSTDESK_API_RUSTDESK_KEY=${RUSTDESK_API_RUSTDESK_KEY}
+      - RUSTDESK_API_RUSTDESK_JWT_KEY=${RUSTDESK_API_RUSTDESK_JWT_KEY}
+      - RUSTDESK_API_LANG=en
+      - RUSTDESK_API_APP_DISABLE_PWD_LOGIN=true
+      - RUSTDESK_API_ADMIN_TITLE=Gib's Rustdesk
+      - RUSTDESK_API_ADMIN_HELLO=<h1>Welcome to Gib's Rustdesk<h1>
+      - ENCRYPTED_ONLY=1
+      - RUSTDESK_API_RUSTDESK_WEBCLIENT_MAGIC_QUERYONLINE=1
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./volumes/server:/data:Z
+      - ./volumes/api:/app/data:Z
+    restart: unless-stopped
+    tty: true