infra: relocate docker-30 compose stack under vms-home/, add garage and frisbee-drills

Move the docker-30 service definitions (gitea, kanidm, vault, zot,
nginx, lab-proxy, maru-hleda-byt, fuj-management) into vms-home/ to
match the naming convention used for other hosts, and add the new
garage object-storage and frisbee-drills services alongside it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

vms-home/docker-30/garage/docker-compose.yml

@@ -0,0 +1,42 @@
+services:
+  garage:
+    image: dxflrs/garage:v2.3.0
+    container_name: garage
+    restart: unless-stopped
+    networks: [garage]
+    ports:
+      - "3900:3900"   # S3 API  (LAN-reachable for your other services)
+      - "3902:3902"   # S3 web
+      # - "3901:3901" # RPC — only publish once you go multi-node
+    volumes:
+      - /srv/docker/garage/garage.toml:/etc/garage.toml:ro
+      - /srv/docker/garage/meta:/var/lib/garage/meta
+      - /srv/docker/garage/data:/var/lib/garage/data
+      - /srv/docker/garage/snapshots:/var/lib/garage/snapshots
+    healthcheck:
+      test: ["CMD", "/garage", "status"]   # image is distroless; use the binary, not curl
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+  garage-webui:
+    image: khairul169/garage-webui:1.1.0
+    container_name: garage-webui
+    restart: unless-stopped
+    networks: [garage]
+    depends_on:
+      garage:
+        condition: service_healthy
+    ports:
+      # - "127.0.0.1:3909:3909"   # bind localhost only — reverse-proxy in front for TLS/auth
+      - "3909:3909"
+    volumes:
+      - /srv/docker/garage/garage.toml:/etc/garage.toml:ro
+    environment:
+      API_BASE_URL:    "http://garage:3903"   # override self-pointing default
+      S3_ENDPOINT_URL: "http://garage:3900"
+
+networks:
+  garage:
+    driver: bridge

vms-home/docker-30/garage/garage.toml

@@ -0,0 +1,28 @@
+metadata_dir           = "/var/lib/garage/meta"
+data_dir               = "/var/lib/garage/data"
+metadata_snapshots_dir = "/var/lib/garage/snapshots"
+db_engine              = "lmdb"
+
+metadata_fsync                  = true
+metadata_auto_snapshot_interval = "6h"    # LMDB corruption insurance
+compression_level               = 2
+replication_factor              = 1        # single node; bump when you add nodes
+
+rpc_bind_addr   = "[::]:3901"
+rpc_public_addr = "127.0.0.1:3901"         # self-RPC only on single node
+rpc_secret      = "REPLACE_rpc_secret"     # openssl rand -hex 32
+
+[s3_api]
+s3_region     = "garage"
+api_bind_addr = "[::]:3900"
+root_domain   = ".s3.garage"
+
+[s3_web]
+bind_addr   = "[::]:3902"
+root_domain = ".web.garage"
+index       = "index.html"
+
+[admin]
+api_bind_addr = "[::]:3903"
+admin_token   = "REPLACE_admin_token"      # webui reads this for auth; openssl rand -hex 32
+metrics_token = "REPLACE_metrics_token"    # openssl rand -hex 32